Subject: Re: [pkix] Off-topic: OCSP response times and drop rates

From: Peter Gutmann <[email-masked]>
Date: Tue, 23 Apr 2013 09:49:26 +0000

Erwann Abalea <[email-masked]> writes:

>It's of course possible to have an OCSP service for an offline CA, you only
>need to have an online dedicated OCSP responder, this is completely supported
>by all the browsers. Such a service exists for some (not all) public CAs.

But if there's no AIA present, there's no way to find the OCSP responder.  It
seems to me like the approach is still the same old "CA's never fail or make
mistakes, so we don't need to build in any safeguards".

Peter.

---

From: Erwann Abalea <[email-masked]>
Date: Tue, 23 Apr 2013 12:04:21 +0200

I was replying to your " Is this ostrich-algorithm approach common among
CAs, or do
only some do it?".
Of course, when CA support OCSP service for offline CAs, the AIA extension
is populated accordingly.

2013/4/23 Peter Gutmann <[email-masked]>

-- 
Erwann.