[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

OCSP authorized responder clarification.



In RFC2560 4.2.2.2 the certificate signing an OCSP request is valid if
it:

>    3. Includes a value of id-ad-ocspSigning in an ExtendedKeyUsage
>    extension and is issued by the CA that issued the certificate in
>    question."

A certain CA issues end user certificates signed by an intermediate CA
which is in turn signed by the root CA. 

The responder certificate is signed by the root CA. Does this, as
appears to be the case, mean that the above condition does not apply
because the OCSP reponder certificate is not signed by the intermediate
CA?

Alternatively is the condition satisfied because they both have the same
root CA?

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: shenson@xxxxxxxxxxxxxxxxxxxxxxxxxxx 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: drh@xxxxxxxxxxx PGP key: via homepage.