RE: FW: Attribute used to store cached certificate chains?

[Stephen Kent <kent@xxxxxxx>]

andrew,

>I think a re-statement and perhaps some may think oversimplification of the
>case is as follows: -
>
>CRLs are a batch method for publishing CRLs and we are agreed that an online
>realtime mechanism is required.
>A client navigating to a single OCSP server looks ok.
>When there are myriad of OCSP servers, the job becomes far more complex.
>A rationalisation of this is to have a single OCSP server that via backend
>protocols talks to other OCSP servers on the users behalf.

I can put the name of one OCSP server into a cert and have many instances
of that server available, for reliability.  We do this with web servers
quite well today, so this is not an unsolvable problem.  Also, having lots
of OCSP servers is not intrinsically a problem; the problem you cite seems
to arise only when a given cert might be checked by many independent
servers.  I've not seen compelling arguments suggesting why such an
arrangement is needed.

Steve