Merely because of private interest and usage in my own network, I'm creating a certificate chain (Root CA → Intermediate CA → Server cert) using openssl. I'd like the certificate chain to be traceable and also being able to revoke certificates.
At the moment, I am not sure, which CRL distribution Points (crlDistributionPoints
in openssl config speech) and OSCP URIs (authorityInfoAccess = OCSP;URI: ...
and authorityInfoAccess = OCSP;caIssuers: ...
) are the correct ones to set when creating a certificate. Examining the certificates of some public websites, it seems to me, that the following is the way to go. So, would you please check whether I'm right?
Root CA certificate:
- CRL: Root CA CRL or none at all
- OCSP URI: OCSP URI of Root CA or none at all
- CA Issuer: URI of Root CA certificate or none at all
Intermediate CA certificate:
- CRL: Root CA CRL
- OCSP URI: OCSP URI of Root CA
- CA Issuer: URI of Root CA
Server certificate:
- CRL: Intermediate CA CRL
- OCSP URI: OCSP URI of Intermediate CA*)
- CA Issuer: URI of Intermediate CA
*) It seems, one OCSP responder could handle OSCP requests for the Root and the intermediate CA. If so, I could also use the Root CA's OSCP URI, right?
So, every certificates data have to point "one level up", to the location, where its own validity can be checked. Is that correct?
Thank you in advance!