Subject: Re: [pkix] ACs an OCSP

From: 王文正 <[email-masked]>
Date: Mon, 14 Apr 2014 15:08:09 +0000

Right, an AA might be a CA as well, but this is not always the case. If an AA wants to legally act as a CA, its certificate must contain the BasicConstrains extension with cA=true and its KeyUsage Extension must at least contain keyCertSign bit. Otherwise, OCSP responder certificate signed by the AA will be rejected by RFC-5280 compliant certificate path validators.

Wen-Cheng Wang

-------- 原始郵件 --------
自： Johannes Merkle <[email-masked]>
日期：
至： 王文正 <[email-masked]>,[email-masked]
主旨： Re: [pkix] ACs an OCSP

Right, but there is no reason, why an AA should not be a CA as well, and if it only issues OCSP signer certs.

--
Johannes