Is this Public Key Infraestructure possible according with the RFC 6960 Online Certificate Status Protocol - OCSP, Authorized Responders?
OCSP response for
Cert is signed with a certificate issued by
Sub CA 2.
Reading the specification for the signature of an Authorized Responder
- Matches a local configuration of OCSP signing authority for the certificate in question, or
- Is the certificate of the CA that issued the certificate in question, or
- Includes a value of id-kp-OCSPSigning in an extended key usage extension and is issued by the CA that issued the certificate in question as stated above.
I am not sure if this case is allowed. My own answer will be NO, but also is present
Note: For backwards compatibility with RFC 2560 [RFC2560], it is not prohibited to issue a certificate for an Authorized Responder using a different issuing key than the key used to issue the certificate being checked for revocation. However, such a practice is strongly discouraged, since clients are not required to recognize a responder with such a certificate as an Authorized Responder