I am currently defining a PKI for code signing certificates on an embedded device (without internet connection). I define the behavior of the certificate issuer(FW release authority) as well as the FW code which will authenticate the certificate of the public key used to sign it upon FW update, I want to define a strategy for checking revocation status of code-signing certificates issued by a CA. the general system will work as follows :
1.firmware code shall be signed by a private key(key#1priv)
2.The public key paired with that private key(key#1pub) shall be sent in a csr (constructed by a HSM) to the CA and obtain a code signing certificate
3.CA's public key will be downloaded to the drive in a secured way
4.During FW update the FW will receive the certificate for key#1pub , authenticate it with CA's public key and then proceed with the authentication of the FW code using key#1pub
My question is:
In case the CA's private key was compromised, from my understanding , a csr shall be sent again to the CA and a new certificate shall be obtained signed by the revocated private key. according to what I understood from online reading , a OCSP request shall be sent to the CA is order to find the revocation status of the certificate according to its serial number , how does the certificate requester knows when to issue such OCSP request ? in other words , what is the common practice for a timing of sending OCSP requests to the CA?