I'm learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-valid-after date on a client cert?
- Client makes request to my https endpoint
- I check the client's certificate CA's OCSP endpoint to see if the cert has been revoked
- Do I also need to check the client cert dates or does an OCSP revocation occur immediately if the not-valid-after date has been reached?