Subject: Re: [OCSP] are several requests for different CAs at once valid ?

From: [email-masked] (Peter Gutmann)
Date: Thu, 11 Sep 2003 15:36:39 +1200

"Julien Stern" <[email-masked]> writes:

>I was wondering if it was ok to send an OSCPRequest containing requests for
>several certificates issued by different CAs ?

Not a good idea.  The behaviour of implementations a year or two back was:

1. Crash/fail/break in some way and reject the request outright.
2. Return an error response.
3. Ignore all but the first request in the response.

I think I finally managed to track down one of the Identrus-cabal responders
that would handle more than one cert in a request (I can't remember which one
it was).  Maybe things have improved since then, but in general I wouldn't
risk sending more than one cert per request, unless you're controlling the
responder and know that it can handle this.

Peter.

---

From: "Ambarish Malpani" <[email-masked]>
Date: Wed, 10 Sep 2003 22:26:16 -0700

Not sure what Peter's sample set was, but that has always
worked with the Valicert responder.

Regards,
Ambarish

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Peter Gutmann
> Sent: Wednesday, September 10, 2003 8:37 PM
> To: [email-masked]; [email-masked]
> Subject: Re: [OCSP] are several requests for different CAs at once valid
> ?
>
>
>