Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

["Andris Berzins" <[e-mail]>]

Quoting "Piyush Jain" <[e-mail]>:
>> Anyhow, I think that rfc2560bis can not (and should not) make suggestions
>> for specific values.  What values would your OCSP implementation use for
>> "good" or "unknown" responses for the same CA?  Those values look like
>> they might be from the right ballpark.
> 
> 2560-bis states that these values correspond to those in CRLs.
> Implementations that I know of set these values from the CRL for good
> responses and use current time for unknown responses.
> 
> This is how 2560 defines these fields
> - thisUpdate: The time at which the status being indicated is known  to be
> correct
> - nextUpdate: The time at or before which newer information will be
> available about the status of the certificate
> 
> So for non-issued, thisUpdate should be start of CAs validity interval (all
> certs are revoked until they get issued) and nextUpdate should be current
> time (a certificate with that serial can be issued anytime).

That would signal to relying party that relying party has received old information (old thisUpdate)
and would query again on nextUpdate and again would get old response with old thisUpdate and so on.

thisUpdate and nextUpdate should be current time IMHO.


> 
> 
> 
> 
> _______________________________________________
> pkix mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pkix