Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

[[e-mail] (Martin Rex)]

Sean Turner wrote:
> 
> I don't see any requirement in RFC 2560 or 2560bis for clients to order 
> requests according to thisUpdate.

Correct observation.

After this discussion, I believe this lack of documented requirement(s)
(for OCSP response caching and updating of that cache) to be a defect
of rfc2560/rfc2560bis.

rfc2560 provides exactly zero guidance on OCSP response caching,
and when an OCSP responder obtains certificate serial status information
from different information sources, then this creates a potential and
non-obvious ambiguity for implementors.

rfc2560bis introduces the explicit notion of OCSP responders feeding
on multiple information sources (such as CRLs _plus_ direct access
to cert issue records), so I think continued silence on OCSP response
caching and the exact semantics of thisUpdate for OCSP cache updates
a bad idea that may result in real interop problems.

  http://www.ietf.org/mail-archive/web/pkix/current/msg32617.html

-Martin