Subject: Re: "Potentially valid" response state in DPV/DPD rqmts I-D

From: Peter Sylvester <[email-masked]>
Date: Tue, 26 Feb 2002 11:49:05 +0100 (MET)

> 
> The DPV response MAY indicate one of three status alternatives:
> 
>    1) the certificate is valid according to the validation policy.
> 
>    2) the certificate is invalid according to the validation policy. 
>       A secondary status MAY indicate that the certificate is 
>       definitively invalid or potentially valid. 
> 
>       In the former case, if another request was made later on, 
>       the certificate will still be determined as invalid.
> 
>       In the later case, if another request could made later on, 
>       the certificate could possibly be determined as valid. This 
>       condition will occur before a certificate validity period has 
>       begun, while a certificate is suspended, or when, at the time 
>       the server generated the response, all conditions of the 
>       validation policy could not be met.
> 
>    3) the server cannot determine the validity of the certificate.
>       This condition will occur when a certification path cannot be 
>       constructed or some revocation information is unavailable.
> 

Does 3 indicate a temporary or permanent error?

In case of a tempary access problem to a CRl repository, one can
respond corresponding to 'some revocation information is unavailable'
or 'all conditions of the validation policy could not be met'. 

The problem sounds similar to the 'unknown' case of OCSP. Does
it mean 'temporarily not available, try later', or 'status is not
available because the cert is not part of the managed CAs.'

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 26 Feb 2002 12:03:52 +0100

Peter,

> Does 3 indicate a temporary or permanent error?

Good question !

> available because the cert is not part of the managed CAs.'

However, you don't propose a solution.

One way to fix the problem would be to say:

      constructed.

In fact what is important for an application is:

a) valid,
b) (definitively) invalid; no need to try later, it will remain invalid,
c) (temporarily) invalid; if you tried later, then it could be valid,
d) no idea whether it is valid, definitively invalid or temporarily invalid: 
   there is not enough information currently available to determine.

Now, translating this into four, three or even two major statuses is 
a matter of taste.

Denis