Re: [IETF-PKIX] OCSP Status Information on a Certificate

["Alexei V. Vopilov" <alx@xxxxxxxxxxxx>]

=======Marc Branchaud posted:
[. . .]
:
:One thing this exercise has showed me is that "unknown cert" is really a
:useless response value, since it is either bogus or subsumed by other values
:(like "unknown CA").

Should "unknown" statuses be read as followed?

Revocation =  "NotAvailable" // cannot access to CRL information
              "UnknownCA"    // cannot access to unknown CA database
Expiration =  "NotAvailable" // cannot access to known CA database
_contents_
              "UnknownCA"    // cannot access to unknown CA database
Issued     =  "NotAvailable" // cannot access to known CA database _directory_
              "UnknownCA"    // cannot access to unknown CA database

Having this a Responder implementation can support only part of
specification without interoperability problems.
Note there is the difference between "NotAvailable" semantic for
Expiration and Issued statuses.

Note also that nothing (according to spec design)
prevents implementing an OCSP Responder by extending CRLs
issued by a CA (or by just ignoring them at all).

--Alexei