Re: [IETF-PKIX] OCSP using SSL/https

["Patrick C. Richard" <patr@xxxxxxxxx>]

Dan Laska wrote:
>
> It seems that the main purpose of having signed responses in OCSP
> is to authenticate the responder.

I disagree. IMHO, the main purpose is to have a non-repudiable receipt
of status provision, that can be used to attest to an attempt to
reasonably check the status of a certificate.


>
> Would it be useful, and perhaps simplify things, to permit SSL/https
> to be used in the protocol instead of requiring signed responses over
> http?

This would not acheive the above.

>
> I am assuming here that the responder is tightly coupled to the CA.
> If the responder's site certificate is revoked then the responder
> itself would have to get disabled or updated by the CA.

This doesn't take into account multiple responder scenarios...

nor the instance where the OCSP provider has multiple certificates


>
> ==========================================
> Dan Laska
> Frontier Technologies Corp.
> Email: danl@frontiertech.com
> ==========================================

-Pat
--
Patrick C. Richard - patr@xcert.com
Public Key Available via LDAP

"All informational objects are candidates for PKI-based ACLs."
       - yhe