Subject: Re: OCSP and LDAP

From: [email-masked]
Date: Mon, 6 Jan 2003 14:15:46 +0000

> But this, in some environment it is not possible. Let's say the
> CA is in a timed controlled access, unavailable from 8pm to 8am
> (for different reasons, i.e. security, lack of personnel, etc.. )
> and a user asks for revocation at 9pm, should we let the certificate
> being reported as valid till 8am ?

Then the certificate policy under which the EE cert was issued
is inappropriate for the use to which the certificate itself is
being put. If the EE requires up-to-the-minute revocation
information to be available to it's correspondents then it
should make sure it is using a CA that can fulfil these
requirements. Legality first, technology second.

Chris

This  email  and  any  attachments  are confidential and intended for the addressee
only.   If  you are not the named recipient, you must not use, disclose, reproduce,
copy  or  distribute the contents of this communication.  If you have received this
in error, please contact the sender and then delete this email from your system.

---

From: Massimiliano Pala <[email-masked]>
Date: Mon, 06 Jan 2003 15:36:51 +0100

> requirements. Legality first, technology second.

I understand your point and I do agree with you that the policy is at the
first place when setting up a CA.

Anyway I do not agree with you when you state that this is the only way,
at least now that there is the OCSP. As I stated in my last email my
question was about the best method of doing things was, but still I
think the OCSP can behave better than the old CRL mechanisms, otherwise
why implementing OCSP when the client could check the CRL by itself ?

Anyway thank to you all for sharing your point of view on the subject,
although I assume I am the only one supporting this approach to the
OCSP (right?) :-(

-- 

C'you,

	Massimiliano Pala

--o-------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]                [email-masked]
                                                  Tel.:   +39 (0)59  270  094
http://www.openca.org                            Fax:    +39   178  221 8225
http://openca.sourceforge.net                    Mobile: +39 (0)347 7222 365