Folks:
I am looking at both the RFC and version 2 ID for OCSP. Each document contains statements that seem contradictory to me. This relates to the meaning of nextUpdate field in the OCSP SingleResponse. Some places each document states that:
"If nextUpdate is not set, the responder is indicating that newer revocation information is available all the time"
Other places each document states that:
"Responses where the nextUpdate value is not set are equivalent to a CRL with no time for nextUpdate"
Now, this appear contradictory to me since I do not interpret X.509 to imply that absence of nextUpdate field in CRL means near real-time CRL generation.
I assume that the above is editorial oversight and the authors of both the RFC and ID mean that for OCSP, absence of nextUpdate means newer revocation information is available all the time.
Raccoon Eyes
Santosh Chokhani
CygnaCom Solutions, Inc.
7927 Jones Branch Drive, Suite 100 West
McLean, VA 22102
chokhani@xxxxxxxxxxxx
(703) 270-3520 (703) 848-0960 (fax)
www.cygnacom.com
Entrust CygnaCom