2

As Root CA are kept offline for security purposes, how does it sign OCSP Response sent by Client for Intermediate Certificate Status Check?

1 Answer 1

3

OCSP responses may be signed not only by the CA itself, but also a designated OCSP signer. That's an X.509 certificate issued by that CA with the OCSPSigning (1.3.6.1.5.5.7.3.9) extended key usage.

For details see RFC 6960, section 4.2.2.2.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .