Subject: Re: OCSP identifiers

From: Peter Sylvester <[email-masked]>
Date: Thu, 30 Nov 2000 12:20:36 +0100 (MET)

> 
> Rather easy. OCSP server may use any information they wish (e.g. a private
> access to a database of the non revoked certificates from the CA (if this
> exists) or CRLs). Howveer, since the requester wants the same kind of
> response whatever source of information is being used, only the common
> denominator of that information should be used to produce the response. In
> particular there should be no assumption that the OCSP server, * for a
> revocation status query *, has access to more information than the one
> contained in a CRL.
> 

Are you saying that a responder MUST respond 'good' even if it has
access to the actual cert database and knows that the cert does not
exists. 

I think the responder would respond 'unknown' in this case.

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 30 Nov 2000 12:49:16 +0100

Peter,

> Are you saying that a responder MUST respond 'good' 

Certainly not. Thank you for raising the point which highlights that fact
that "good" as a response which is not appropriate. Before telling what is
the appropriate response, it is nice to remember what the question was. :-)

The question was: " What is the revocation status of this certificate ?"

There are only three possible answers : "revoked", "not revoked" or "don't
know".

Denis

>even if it has