Subject: Client-side revocation checking capability

From: Juan Carlos Pérez Aguayo <[email-masked]>
Date: Thu, 10 Aug 2000 12:36:09 -0400

I am in trouble about this: What is  the real support that have the
client-side software for certificate revocation checking now? i.e. (Internet
Explorer, Netscape, etc.)

I heard that, in fact, client-applications don`t do any revocation checking
at all? It's that truly?

What is the real capability of those client applications this time?

By example, I know that Netscape define some certificate extensions for
managing revocation, but I am not sure if realy work

Can anyone give me some help?

Thanks you

Juan Carlos Pérez Aguayo
Software Engineer
Acepta.com
[email-masked]

---

From: "Jeff Spinney" <[email-masked]>
Date: Thu, 10 Aug 2000 18:04:34 -0400

OCSP server vendors such as CertCo (www.certco.com) or Valicert
(www.valicert.com) have toolkits with which you can OCSP 'enable' an
application. This is great for application vendors who wish to make their
apps more robust and certificate enabled. Most applications at this point in
the game are not OCSP enabled even if they can deal with certificates, they
do the basic crypto checking *if* they have the issuer cert on hand, but do
not do real time status checking to see whether or not the cert has been
revoked since it was issued.

	in that regard, it seems as though the application market needs to be
persuaded to make their software support real time certificate status
checking.

	As for Netscape, they do have an OCSP client for their browser. I am unsure
if it is publically available at this time. It loads into the security area,
under 'advanced' and gives you the option to specify an OCSP responder. In
my experiance, and it was in the early stages of this modules lifetime, it
was very finicky.  If i remember correctly, it wanted the OCSP response to
be sgned by the same cert that signed the cert being checked.  This may not
always be the case.

-j

-----Original Message-----
From: Juan Carlos Pérez Aguayo [mailto:[email-masked]]
Sent: Thursday, August 10, 2000 12:36 PM
To: 'Ietf-Pkix
Subject: Client-side revocation checking capability

Thanks you

Juan Carlos Pérez Aguayo
Software Engineer
Acepta.com