Re: [pkix] Straw-poll on OCSP responses for non-revoked certificates.

[Erwann Abalea <[e-mail]>]

2012/10/30 Miller, Timothy J. <[e-mail]>:
[...]
> I disagree in re: lying.  The OCSP responder can respond REVOKED and the CA could add it to the CRL afterward, and a relying party wouldn't be able to tell the difference.

You'll then have to set a revocation date to be set in the CRL, which
might be different than the one defined here. Some asked for epoch,
some asked for 1950, but since you can't use as a revocation date for
a certificate a date earlier than the thisUpdate of a previous CRL in
which that certificate wasn't revoked, a RP will be able to tell the
difference (that's normative).
Of course, this certificate won't be removed from the CRL since you
don't know its expiration date (nice to make a CRL grow indefinitely).
And if the CA has some sort of constraints in its DB (which can be
considered as good practice), then a false certificate may have to be
created and inserted before being able to revoke it.

-- 
Erwann.