Re: [stir] certificates: short-lived or status

[Stephen Farrell <[e-mail]>]

On 15/03/17 23:37, Richard Barnes wrote:
> 
> The main push-back we get from server operators about (2) is that it
> requires outbound connections from web servers -- load and downtime never
> come up as issues.  Outbound connections shouldn't be an issue for STIR
> signers, since they're likely to be making outbound connections all the
> time anyway.  Even if not, it's a simple firewall rule to write to let out
> connections to your CA.

(2) also helps for privacy reasons. (1) would mean the
callee sending a cleartext OCSP query containing the
callers number. (In some cases.)

And FWIW, I'm not sure how the trade-offs between (2a)
and (2b) would apply in the case of stir. (2a) would
be more bytes unless (2b) has one more intermediate CA
cert for some reason, but that could happen so the
trade-offs would need a bit of exploring. The RP may
also have an easier time with (2a) as it is maybe
easier to insist on a fresh stapled OCSP response than
it is to decide when a still-valid cert is too old.

S.