Re: [pkix] Proposed resolution to non-issued certificates - 2560bis

[Tom Ritter <[e-mail]>]

Think I missed this email while sending in my vote, sorry.

On 31 October 2012 14:46, Stefan Santesson <[e-mail]> wrote:

> 1) Extend the "revoked" response to also be allowed for non-issued
> certificates. Clearly stating that this is optional if and only if the
> OCSP responder knows that the requested serial number has never been
> issued.
>

Cool.


> 2) Specify that a "revoked" status for a non-issued certificate serial
> number MUST have revocationTime set to Jan 1, 1970 and MUST set the
> revocationReason to certificateHold (6).
>

Is the 0 unix epoch overloaded/used in other contexts?  Have CAs set this
date as the revocation date in other situations/for legacy reasons?  Would
it be better to use something similar like Jan 2, 1970?  It's another magic
value which is crappy but...


> 2) Define a new optional non-critical extension declaring that OCSP
> responder returns "revoked" for non-issued certificates according to the
> updated standard. This extension MUST be present in all responses where
> the "revoked" response is returned as a result of a status request for a
> non-issued certificate.
>

Cool.



> Question:
> Would it make sense to require an OCSP responder that adopts the expanded
> use of "revoked" to always include the new extension?
> It would add the benefit that someone receiving "good" can know that the
> OCSP responder has checked that the certificate in fact has been issued by
> the CA.
>
In such case it may be reasonable to add an optional data structure which
> MAY contain a hash of the cert.
> Such hash would make the positive confirmation even stronger, adding proof
> of existence of the certificate.
>

I'll register my vote for all these items also - I like the idea of
providing transparency into the operations of the responders.

-tom.