Re: [TLS] New version of the TLS feature draft

[Nikos Mavrogiannopoulos <[e-mail]>]

On Sat, 2014-09-13 at 20:20 -0500, Tom Ritter wrote:
> On 5 September 2014 10:34, Nikos Mavrogiannopoulos <[e-mail]> wrote:
> > I don't see how it does close the door. What should the client do if the
> > server administrator sets up an old version of a valid ocsp staple?
> 
> Section 3.1.1 specifies "a server MUST return a valid OCSP token".   I
> would consider an expired ocsp staple to not actually be valid.  I
> would refer to it as expired, with the implication that the signature
> is correct, because if it wasn't a person probably would have said
> that in addition to describing it as expired.

That's pretty sketchy. OCSP responses have a recommended validity
interval, this is not the same as X.509 certificate expiration. I'm not
sure what popular browsers do with responses received by the server that
are outside the validity period, but I would be very surprised if they
dropped the connection. If in this document it is assumed that responses
not within the recommended interval should cause a TLS connection
failure, it should be explicit.

regards,
Nikos