Re: [TLS] rfc4366-bis: Certificate Status for intermediate CA

[Martin Rex <[e-mail]>]

Martin Rex wrote:
> 
> Yngve N. Pettersen wrote:
> > 
> > However, sending two CertificateStatusRequest extensions in the same  
> > ClientHello is forbidden by RFC 5246 sec 7.4.1.4:
> > 
> >     When multiple extensions of different types are present in the
> >     ClientHello or ServerHello messages, the extensions MAY appear in any
> >     order.  There MUST NOT be more than one extension of the same type.
> 
> How about always using the existing extension for the OCSP response
> for the server certificate, and using a new extension for OCSP responses
> for other certificates (like intermediate CA certs), probably unsorted.
> 
> PKIs with flat hierarchies (Server-cert signed by self-signed CA cert)
> use only the original extension.  Servers with certs from multi-level
> CA hierarchies need to use the new extension if they want to send
> additional OCSP responses.

I mis-explained myself:

Servers would always use the existing TLS extension to convey the
OCSP extension for their end entity cert.  If Servers want to convey
additional OCSP responses (for intermediate CA certs and maybe
from different cert paths), they would additionally have to
use a new extension.

-Martin