Subject: clarification about RFC2560.

From: [email-masked]
Date: Thu, 4 Mar 2004 14:37:49 +0100

Hi,¶ 

I would like a clarification about RFC2560.

We developed a OCSP responder. this responder work with 15 differents CA. I'm
not direct contact with this 15 CA. That implies that I have intern CA which
signed my certificate of responder OCSP.

I would like to know, because item 4.2.2 is not very clear in its formulation
for me. If it is possible compared to the RFC2560, to ask the requestor to trust
my CA I cannot be certified by the 15 other CA.

The responder OCSP not have a link with the certificates for which one carries
out a request for status. In this case, one simply asks the requestor to make
trust to the AC which with signed the certificate of responder OCSP.

This case is possible ?

Thanks
Yannick Quenec'hdu

---

From: "Miguel Rodriguez" <[email-masked]>
Date: Thu, 4 Mar 2004 12:24:09 -0600

> my CA I cannot be certified by the 15 other CA.

Yes it is possible according to RFC2560, quoting from section 4.2.2.2:

"They MAY provide a means of locally configuring one
   or more OCSP signing authorities, and specifying the set of CAs for
   which each signing authority is trusted. They MUST reject the
   response if the certificate required to validate the signature on the
   response fails to meet at least one of the following criteria:

   1. Matches a local configuration of OCSP signing authority for the
   certificate in question; or

   2. Is the certificate of the CA that issued the certificate in
   question; or

   3. Includes a value of id-ad-ocspSigning in an ExtendedKeyUsage
   extension and is issued by the CA that issued the certificate in
   question."

Your clients would have to be locally confuigured to trust your OCSP
responder, 
and when validating the response they would be using case 1 in the above
quote.

> trust to the AC which with signed the certificate of responder OCSP.

I guess you're using a "CRL Pull Mode" here, where your OCSP responder
is also a "default" responder contacted by all your clients for every
revocation check. Hope this helps,

Miguel Rodriguez
SeguriData
Mexico

---

From: [email-masked]
Date: Thu, 4 Mar 2004 22:17:39 +0100

Hi,

> revocation check. Hope this helps,
It is exact, I use this operating mode well. Thank you with all for your
assistance and your reactivity.

Bye
Yannick Quenec'hdu