Subject: RE: Clarification request on RFC 2560

From: Ambarish Malpani <[email-masked]>
Date: Fri, 14 Sep 2001 09:42:30 -0700

Hi Rich,

    Are you referring to the issue of a single VA/OCSP Responder
supplying delegated certificates from multiple CAs in a response?

    If so, I wouldn't go quite that far. I know of at least one
implemenation that does support this behavior (and don't think
there are 999,999 other implementations of OCSP out there...)

:-)

Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Rich Salz [mailto:[email-masked]]
> Sent: Friday, September 14, 2001 7:53 AM
> To: Dr S N Henson
> Cc: Pkix (E-mail)
> Subject: Re: Clarification request on RFC 2560
> 
> 
> 
> > An OCSP client might assume that only a single certificate 
> corresponds
> > to the responder ID and for example just look for the first 
> certificate
> > in the certs attribute which matches the reponder ID and 
> verify that.
> 
> I think most -- like 99.9999% -- PKI programs are not 
> equipped to handle
> cross-certified entities.
> 	/r$
> 
> -- 
> Zolera Systems, Your Key to Online Integrity
> Securing Web services: XML, SOAP, Dig-sig, Encryption
> http://www.zolera.com
>

---

From: Rich Salz <[email-masked]>
Date: Fri, 14 Sep 2001 13:45:57 -0400

It sure sounded like Ryan's note ssaid a single key with multiple CA's
verifying it, and the client finds the right verifier.  Or does your VA
product use a separate keypair for each CA it handles?

>issue of a single VA/OCSP Responder ...

You sure you want to risk losing your TM on "Validation Authority" by
consistently using it generically? :)
	/r$
-- 
Zolera Systems, Your Key to Online Integrity
Securing Web services: XML, SOAP, Dig-sig, Encryption
http://www.zolera.com