Re: [TLS] Status of X.509v3 TLS Feature Extension?

[Geoffrey Keating <[e-mail]>]

[e-mail] (Martin Rex) writes:

> Processing multiple OCSP responses from the TLS multiple certificate status
> extension will also be interesting for TLS client that essentially throw
> away everything but the Server certificate from the Server's TLS Certificate
> handshake message and perform a new path discovery, because the resulting
> path may be different from the one that was sent by the server.

This is only a problem if the new path discovery might use
certificates which weren't sent from the server (built-in
intermediates or ones fetched from the web), for which of course the
server won't have sent OCSP responses.  Another way to put this is
that the server needs to send all necessary intermediates for OCSP
stapling to work properly.