Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

[[e-mail] (Martin Rex)]

Stefan Santesson wrote:
>
> "Piyush Jain" <[e-mail]> wrote:
> > 
> >[Piyush] Which original guidance? There is a note that says that these
> >values correspond to the values in the CRL.
> 
> They do.
> 
> Correspond = to be similar or analogous; be equivalent in function,
> position, amount, etc.
> (http://dictionary.reference.com/browse/correspond)
> 
> ThisUpdate in CRL (http://tools.ietf.org/html/rfc5280#section-5.1.2.4)
> 
> So it is analogous to the issuance date of a CRL, not necessarily THE
> issuance date of a CRL.

Correct.  thisUpdate/nextUpdate is determined by the OCSP responder.

It might be copied from a base CRL used in determining the certificate
serial status (even for CAs that publish deltaCRLs, in case that
the OCSP responder supports only baseCRLs).

It might be copied from a delta CRL.

It might be based on meta-knowledge about _real_ update frequency of
base&delta CRLs (rather than the nextUpdate validity suggestion
that is conveyed within base&delta CRLs nexUpdate).

It might be based on other information sources besides CRLs, to which the
OCSP responder has access, such as direct access to a CA cert status
database, and not be related to any CRLs.

-Martin