If the OCSP signing is delegated explicitly to another entity and that delegated OCSP responder is compromised, how to revoke the certificate and convey the revocation information to a client? We need CRL for this?

1 Answer 1


OCSP signing certificates are not normally revoked. Clients are made aware of this requirement using the non-critical id-pkix-ocsp-nocheck extension. To reduce the effect of a compromise of these certificates they are normally issued with a short lifetime.

However, this isn't the only option. OCSP signing certificates could be revocable and checks could be carried out using a CRL or any method described in RFC 5280's Authority Information Access. Note that this only defines OCSP as an option, in which case it would need to be a different OCSP responder to be meaningful.

Details are in RFC 6960 Section

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.