Re: OCSP and LDAP

[chris.gilbert@xxxxxxxxxxxxx]

> But this, in some environment it is not possible. Let's say the
> CA is in a timed controlled access, unavailable from 8pm to 8am
> (for different reasons, i.e. security, lack of personnel, etc.. )
> and a user asks for revocation at 9pm, should we let the certificate
> being reported as valid till 8am ?

Then the certificate policy under which the EE cert was issued
is inappropriate for the use to which the certificate itself is
being put. If the EE requires up-to-the-minute revocation
information to be available to it's correspondents then it
should make sure it is using a CA that can fulfil these
requirements. Legality first, technology second.

Chris



This  email  and  any  attachments  are confidential and intended for the addressee
only.   If  you are not the named recipient, you must not use, disclose, reproduce,
copy  or  distribute the contents of this communication.  If you have received this
in error, please contact the sender and then delete this email from your system.