Subject: RE: OCSP & Authority Information Access

From: Michael Myers <[email-masked]>
Date: Tue, 19 Jan 1999 08:15:22 -0800

Denis,

That text has been there since the first draft.  Last Call has come and gone
and OCSP is now up at the IESG.  So it's a bit late to go changing things
right now.  But, for what it's worth, just because CAs (and, by inference,
cert servers) are required to "provide the capability" doesn't mean they're
required to use it (or that the capability in the cert server is required to
be used).  You can operate your CA without using the noted extension and
still comply with the spec.

Also, the extension is intended to point upward in a chain to an issuing CA,
not downward to certs.  That too has been the case since the earliest drafts
of Part 1.

Lastly, I would not advise anyone to configuring such a pointer into root
certs since it bakes in a system configuration that they might want to
change at some later date.

Mike

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 19 Jan 1999 17:40:58 +0100

Michael,

Thanks for your very fast response.

> be used).

You said:

> You can operate your CA without using the noted extension and

I would like that !

The text however says:

"CAs SHALL provide the capability to include the AuthorityInfoAccess extension
(defined in [PKIX1], section 4.2.2.1) in certificates that can be checked using
OCSP."

I have thus difficulties to interpret that sentence and understand what the
SHALL means.

> change at some later date.

Self signed certificates my change over time. If this is not included in a leaf
certificate, I do not see another (secure) means to give the pointer.

Regards,

Denis