5

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?

3
  • Can you provide a reference for the requirement that requests must be signed? I haven't looked in depth, but skimming the RFC I don't see anything about signing requests. Commented May 21, 2019 at 19:14
  • @AndrolGenhald - Section 4.1.1 of RFC6960 has the OCSPRequest made up of a tbsRequest and an optionalSignature. Commented May 21, 2019 at 19:26
  • @garethTheRed Ah, thanks! The way I was reading the question it made it sound like there was a mandatory signature, but I guess this wasn't OP's intent. Commented May 21, 2019 at 19:44

2 Answers 2

5

The best I can find is from a draft version 2 of X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP proposal, which later became RFC 2560. It states that:

The requester signature is used to authenticate the requester to the OCSP Responder. It is used in conjunction with the requester certificate extension defined below.

This document is also the first instance of the signature in the ABNF breakdown of the request. Later versions of the document say even less about the subject.

The signature has to be optional as many (if not most) relying parties will not have a public/private key pair with which to sign the OCSP Request.

In addition to this vagueness, the The Lightweight Online Certificate Status Protocol (OCSP) Profile for High-Volume Environments protocol defined in RFC 5019 says the following about signed requests:

Clients SHOULD NOT send signed OCSPRequests. Responders MAY ignore the signature on OCSPRequests.

In neither documents is there a reason for expecting a client to sign the request.

0
3

The connection to the OCSP responder does not need to be protected by HTTPS (it often is HTTP only) and the OCSP responder does not even need to be the authoritive source for the OCSP response, it can just forward responses it got from somewhere else. The signature instead is done by the authoritive source.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .