Subject: [TLS] Security of CertificateStatus?

From: Mike <[email-masked]>
Date: Fri, 16 Feb 2007 10:04:08 -0800

I am concerned about the CertificateStatus extension.
It only allows for one OCSP response which is the
validity of the server's certificate.  The problem I
see is that most certificate chains have intermediate
CA's and their status should also be checked by the
client.

I'm not too familiar with OCSP yet, so am I missing
something?  Does the OCSP response contain the
validity of an entire certificate chain?

Thanks,

Mike

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Mike <[email-masked]>
Date: Sat, 17 Feb 2007 09:58:27 -0800

> You either need to validate the chain (plus CRL), or you need OCSP, not both. 
> Either allows you to tell if the certificate presented by the server is 
> valid. If the certificate is valid, you can "trust" the server.

When I validate a typical certificate chain, my code ends up
retrieving up to 4 CRLs since the CRLs of intermediate CAs
need to be checked too.  Does the single OCSP response also
validate these intermediate CA certificates?

Mike