Subject: RE: clarification about RFC2560.

From: [email-masked]
Date: Thu, 4 Mar 2004 18:13:57 +0100

Selon "[email-masked]" <[email-masked]>:

> Selon Dave Engberg <[email-masked]>:
> 
>  
>  If your responder does not have a delegated certificate (with the "OCSP
>  Signing" Extended Key Usage) from each Certificate Authority, then your
>  responder certificate must be explicitly trusted by every client that uses
>  your responder.
>  
>  OCSP clients make this possible by allowing you to specify "explicitly
>  trusted" responder certificates at each client.
>  
>  It is not possible to ask the client to accept your responder cert if that
>  cert is not issued by the CA of the cert they are checking.
>  
Your third sentence seems to conflit with the previous one. is it just a
 miss use or really impossible ?
> 
> Thanks 
> Yannick Quenec'hdu
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]
> On
> > Behalf Of [email-masked]
> > Sent: Thursday, March 04, 2004 8:38 AM
> > To: [email-masked]
> > Subject: clarification about RFC2560.
> > 
> > 
> > Hi,¶ 
> > 
> > I would like a clarification about RFC2560.
> > 
> > We developed a OCSP responder. this responder work with 15 differents CA.
> I'm
> > not direct contact with this 15 CA. That implies that I have intern CA
> which
> > signed my certificate of responder OCSP.
> > 
> > I would like to know, because item 4.2.2 is not very clear in its
> formulation
> > for me. If it is possible compared to the RFC2560, to ask the requestor to
> > trust my CA I cannot be certified by the 15 other CA.
> > 
> > The responder OCSP not have a link with the certificates for which one
> > carries out a request for status. In this case, one simply asks the
> requestor
> > to make trust to the AC which with signed the certificate of responder
> OCSP.
> > 
> > This case is possible ?
> > 
> > Thanks
> > Yannick Quenec'hdu
> > 
> > 
> > 
> > 
> > 
> 
> 
> 
>