Re: CA=True for an OCSP certficat

[Stephen Kent <kent@xxxxxxx>]

Peter,

I expect the CA flag to be set to TRUE only in a cert used to 
validate signatures on other certs, and/or signatures on CRLs.

A cert for an EE contains no basic constraints extension, or one in 
which the CA flag is FALSE.

A cert issued to a service run by a CA, such as OCSP server or a time 
stamp server is not  CA cert, but an EE cert, i.e., it is used to 
verify signatures on objects others than certs or CRLs, and thus it 
MUST not have the CA flag set TRUE.

Steve