I am reading a tutorial about OpenSSl CA installation and after setting up the CA, they say that we now generate a pair for the OCSP because it needs to sign its responses.

I am confused at this point. I mean, even if there was a man in the middle impersonating the OCSP(which the purpose of signing messages), it can't do any harm, since it doesn't know the CA private key, so it can't sign arbitrary certificates, right ?

Second, how would the client even get the OCSP's public key, if it only knows the CA one ? It has to contact the CA, but a CA only communicate through its OCSP so an impersonator can still MITM and act as the OCSP anyway

  • 1
    Can you share the document that you are referring to so that we can help you out? – kudrom Oct 25 '20 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.