New answers tagged


OCSP signing certificates are not normally revoked. Clients are made aware of this requirement using the non-critical id-pkix-ocsp-nocheck extension. To reduce the effect of a compromise of these certificates they are normally issued with a short lifetime. However, this isn't the only option. OCSP signing certificates could be revocable and checks could ...

Top 50 recent answers are included