Subject: Re: [pkix] Off-topic: OCSP response times and drop rates

From: Peter Gutmann <[email-masked]>
Date: Tue, 23 Apr 2013 08:00:58 +0000

Piyush Jain <[email-masked]> writes:

>It is very rare to find OCSP AIAs in subordinate CA certificates and for good
>reason. Root CAs are typically kept offline and they issue certificates/CRLs
>very infrequently. Size of CRLs issued by these CAs is very small (a few or
>zero entries), so it does not make sense to provide revocation status for
>certificate issued by such CAs through OCSP from operational perspective.

So if another Diginotar happens there's still going to be no effective way to
revoke the certs?  Is this ostrich-algorithm approach common among CAs, or do
only some do it?

Peter.

---

From: Erwann Abalea <[email-masked]>
Date: Tue, 23 Apr 2013 11:14:02 +0200

It's of course possible to have an OCSP service for an offline CA, you only
need to have an online dedicated OCSP responder, this is completely
supported by all the browsers. Such a service exists for some (not all)
public CAs.

2013/4/23 Peter Gutmann <[email-masked]>

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

-- 
Erwann.

---

From: "Piyush Jain" <[email-masked]>
Date: Tue, 23 Apr 2013 06:59:58 -0700

> >It is very rare to find OCSP AIAs in subordinate CA certificates and
> >for good reason. Root CAs are typically kept offline and they issue
> >certificates/CRLs very infrequently. Size of CRLs issued by these CAs
> >is very small (a few or zero entries), so it does not make sense to
> >provide revocation status for certificate issued by such CAs through OCSP
> from operational perspective.
> 
> revoke the certs?  Is this ostrich-algorithm approach common among CAs, or
> do only some do it?
> 
[Piyush] Not providing revocation status through OCSP is not the same as not
providing revocation status at all. Revocation source is the CRL referenced
in the CRLDP extension.

---

From: "Piyush Jain" <[email-masked]>
Date: Tue, 23 Apr 2013 07:43:36 -0700

It's of course possible to have an OCSP service for an offline CA, you only need to have an online dedicated OCSP responder, this is completely supported by all the browsers. Such a service exists for some (not all) public CAs.

[Piyush] True. 

However, my point is that having an OCSP service for a CA who issues only a few certificate (translates to really small CRLs) provides no benefit because the cost of providing revocation status through CRLs would be lot less that providing them through OCSP.