If the OCSP signing is delegated explicitly to another entity and that delegated OCSP responder is compromised, how to revoke the certificate and convey the revocation information to a client? We need CRL for this?

1 Answer 1


OCSP signing certificates are not normally revoked. Clients are made aware of this requirement using the non-critical id-pkix-ocsp-nocheck extension. To reduce the effect of a compromise of these certificates they are normally issued with a short lifetime.

However, this isn't the only option. OCSP signing certificates could be revocable and checks could be carried out using a CRL or any method described in RFC 5280's Authority Information Access. Note that this only defines OCSP as an option, in which case it would need to be a different OCSP responder to be meaningful.

Details are in RFC 6960 Section

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .