0

If the OCSP signing is delegated explicitly to another entity and that delegated OCSP responder is compromised, how to revoke the certificate and convey the revocation information to a client? We need CRL for this?

Improve this question

1 Answer 1

Reset to default
1

OCSP signing certificates are not normally revoked. Clients are made aware of this requirement using the non-critical id-pkix-ocsp-nocheck extension. To reduce the effect of a compromise of these certificates they are normally issued with a short lifetime.

However, this isn't the only option. OCSP signing certificates could be revocable and checks could be carried out using a CRL or any method described in RFC 5280's Authority Information Access. Note that this only defines OCSP as an option, in which case it would need to be a different OCSP responder to be meaningful.

Details are in RFC 6960 Section 4.2.2.2.1.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .