[TLS] OCSP stapling problem

["T.Tributh" <[e-mail]>]

Hi,

first I may introduce my problem.

We take a small mail server, in this case exim and enabling TLS with an
OCSP-Must-Staple certificate. We add the status_request
like described in  RFC 6066 and everything works fine for all clients
connecting to that server and send mail.
Now we turn to sending out a mail. In this moment this server become a
client connecting to another server, which can request our certificate.
We serve (this) Must-Staple certificate, but the status_request from RFC
6066 is not included and the server should see this certificate as
"invalid".

some more details under:
https://bugs.exim.org/show_bug.cgi?id=2350


In RFC 6066:
Constrained clients may wish to use a certificate-status protocol
   such as OCSP [RFC2560] to check the validity of server certificates,


there is no information about the other direction, where a server may
request from a client ....


RFC 8446 section 4.4.2.1
A server MAY request that a client present an OCSP response with its
   certificate by sending an empty "status_request" extension in its
   CertificateRequest message.

So RFC8446 changes RFC6066 in the way that also a server can request OCSP.
Is that only intended to match for TLS 1.3 ?
Or does this change is meant also for TLS 1.2, where implementations
actually lacking this case?

Should in this case RFC 6066 changed to make the "server request from
client" case being also described?

In the moment such a mail system must have two certificates for the
server and the client mode to offer a valid cert until TLS libraries
have offered both methods.

I assume the same problem for example also for XMPP where the server is
changing to client mode too.
There may be much more protocols, which I have not in mind now.

Am I getting this right?

Kind regards

Torsten Tributh