Re: [pkix] Two way OCSP Stapling and Configuring Windows responder URLs w/o AIA presence

[Russ Housley <[e-mail]>]

Online Certificate Status Protocol (OCSP) is specified in RFC 6960.

The TLS Certificate Status Request extension is defined in Section 8 of RFC 6066, which says:

   Servers that receive a client hello containing the "status_request"
   extension MAY return a suitable certificate status response to the
   client along with their certificate.  If OCSP is requested, they
   SHOULD use the information contained in the extension when selecting
   an OCSP responder and SHOULD include request_extensions in the OCSP
   request.

and

   Note in addition that a server MUST NOT send the "CertificateStatus"
   message unless it received a "status_request" extension in the client
   hello message and sent a "status_request" extension in the server
   hello message.

I do not see anything about the client providing an OCSP response for their own certificate.

Russ


On Jun 21, 2016, at 9:11 AM, daniel bryan <[e-mail]> wrote:

> I believe i understand the concept of OCSP stapling in regards to a webserver presenting it's own certificate status to the browser client in the TLS handshake. I am curious if a client (personal certificate with digital signature key usage) authenticating to a webserver with their certificate can also present it's own certificate status so the webserver doesn't have to determine the status from an OCSP service. 
> 
> 1.) Does the standard allow for this? I believe it does since the verbage says "It allows the presenter of a certificate to bear the resource cost involved in providing OCSP responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS Handshake"
> 
> 2.) How is this configured in client browsers, are 3rd party addons required?
> 
> Vaguely related, but i remember their being a dependency on windows ability to provide a stapled response via IIS. It required the presence of an OCSP url in the webservers AIA field. I would like to overwrite/hardcode the URL, like you can do in (certmgr.msc) certificate properties adding a responder URL. Sort of like doing a "SSLStaplingForceURL uri" directive in apache.  I posted this question on the iss forums about this, but was not able to get a resolution. http://forums.iis.net/t/1221792.aspx?OCSP+STAPLING+ForceURL+Option
> 
> 
> 1.) Is it possible to configure windows to use a specific responder url for providing stapled responses when an ocsp url is not present in the AIA of the servers certificate?
> 
> 
> 
> 
> Thanks,
> 
> Dan