IETF Logo Mail Archive

Re: [pkix] Proposed resolution to non-issued certificates - 2560bis

Simon Tardell <simon@tardell.se> Fri, 02 November 2012 16:25 UTC

Return-Path: <simon@tardell.se>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA51611E80D2 for <pkix@ietfa.amsl.com>; Fri, 2 Nov 2012 09:25:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.976
X-Spam-Level:
X-Spam-Status: No, score=-2.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gw-AqE-LNyTj for <pkix@ietfa.amsl.com>; Fri, 2 Nov 2012 09:25:00 -0700 (PDT)
Received: from mail-lb0-f172.google.com (mail-lb0-f172.google.com [209.85.217.172]) by ietfa.amsl.com (Postfix) with ESMTP id 25C7111E80C5 for <pkix@ietf.org>; Fri, 2 Nov 2012 09:24:59 -0700 (PDT)
Received: by mail-lb0-f172.google.com with SMTP id k13so2981908lbo.31 for <pkix@ietf.org>; Fri, 02 Nov 2012 09:24:58 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:x-gm-message-state; bh=9OwsUyx39VcQr1x0OT7izYPMpyaDSlGLMojLh/bgs0E=; b=ow6QDhyZbGrHotlyG9PTIyUdZVSMiv1u6NFQobY3Pvy/KQxG/HDe4LcDe9f2WUQGdf Apk2+xrQYV0zYwBC0SEGAPeK7iw8MnY2z+pjHnarVQnGTDFeTT12tsBRVtM/QlTd6grI MZPhMNNQbGGlHvKVqND3xJmXIyRoos40stYJRWgrHrb3ewia+jYh7NMmHW6TAf4R/jat I+Kay1VUZSpv3fLgPrg4vM8GqyrZoTJJWdXVHxTGj8SDHCzpGX98znXFtgQPMPtXTtXo doeo8VBq2PRoVUGlrdsGMNsH//6D3u/mwvBz5UbCxMqO3v2Vu61LmUdoPuvpX6JKJUwx EzDg==
MIME-Version: 1.0
Received: by 10.152.105.236 with SMTP id gp12mr2135671lab.35.1351873498860; Fri, 02 Nov 2012 09:24:58 -0700 (PDT)
Received: by 10.112.134.102 with HTTP; Fri, 2 Nov 2012 09:24:58 -0700 (PDT)
In-Reply-To: <CAFD47=oddnrbHepUX4PHi8zLqjqE=_vvOzP1wmZ+kRANNAEvdw@mail.gmail.com>
References: <034701cdb87e$0f083a80$2d18af80$@ditenity.com> <201211021016.qA2AGYZA000373@mail.nbusr.sk> <CANkYYy5TsTajY4hztaHaFeWsUYd+d+7st_yKCcqUAkdWNY6BMw@mail.gmail.com> <CAFD47=oddnrbHepUX4PHi8zLqjqE=_vvOzP1wmZ+kRANNAEvdw@mail.gmail.com>
Date: Fri, 02 Nov 2012 17:24:58 +0100
Message-ID: <CANkYYy6owHPy_CxEDK1yhNogED2+AYC-mE3neyio5VJcyn6CPg@mail.gmail.com>
From: Simon Tardell <simon@tardell.se>
To: Peter Rybar <peterryb@gmail.com>
Content-Type: multipart/alternative; boundary="f46d0407144bae4d6304cd8593d6"
X-Gm-Message-State: ALoCoQnusRLi52tI5Ib7Zs9dRfPYztSGQDeJia/ncOhqSVd21EMtk617sh1zqW6X1HjxotF3sEB0
Cc: Stefan Santesson <stefan@aaa-sec.com>, "pkix@ietf.org" <pkix@ietf.org>
Subject: Re: [pkix] Proposed resolution to non-issued certificates - 2560bis
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Nov 2012 16:25:01 -0000

On Fri, Nov 2, 2012 at 4:44 PM, Peter Rybar <peterryb@gmail.com> wrote:

> It means the time value in thisUpdate field is a time when CA database
> was locked in the process of creating CRL/OCSP response. CRL contains
> only revocations with time which were before time value of thisUpdate
> field. Any revocatins registered while database was locked must not be
> included and are included after next lock of CA database when a new
> CRL will be generated.
>

I am not sure I follow you. Why does the OCSP responder have to care about
when the CRLs are produced (if there are any at all) if it has access to
the database?

/Simon

v2.23.0 | Report a Bug | By Email