Subject: How should an OCSP responder cope with policy IDs

From: "Brian.Clarke" <[email-masked]>
Date: Fri, 4 Aug 2000 12:34:31 +0100

While implementing an OCSP responder we have been considering how to process
extensions in requestors' certificates, i.e. if an OCSP request is signed,
we should handle any extensions present in the signer's certificate
correctly.

Do people have a view on how a critically marked policy ID extension
(id-ce-certificatePolicies) should be handled?

For example, would the OCSP responder be expected to check the policy IDs
against a list of known IDs. If the IDs were found the responder would then
accept the request, but if a policy ID which was unknown to the responder
was given, the responder would reject the request.

Alternatively the responder could just ignore the policy Id information and
process the OCSP request regardless.

Any suggestions gratefully received.

Brian.

----------------------------------------------------------------------
This email and any files transmitted with it are intended solely for
the use of the individual or entity to whom they are addressed and may
not be divulged to any third party without the express permission of
the originator.  Any views expressed in this message are those of the
individual sender, except where the sender specifically states them to
be the views of Racal Research Ltd.
----------------------------------------------------------------------