Re: [TLS] rfc4366-bis: Certificate Status for intermediate CA certificates

[Nagendra Modadugu <[e-mail]>]

On Mon, Sep 28, 2009 at 2:59 PM, Yngve N. Pettersen (Developer Opera
Software ASA) <[e-mail]> wrote:
> Hello all,
>
> After the short discussion about this topic in Stockholm, I've now started
> to look into how to define a multi-certificate status extension.
>
> My current thinking is to achieve this with the minimum number of changes
> needed to add the new status information to the protocol.
>
> In my opinion that would mean adding a new enum, ocsp_multi, to the
> CertificateStatusType enum, the same OCSPStatusRequest record (alternatively
> a list of them, but I do not think that is desirable), and a new
> MultipleOCSPResponse member to the response union in the CertificateStatus
> message which contain a list of OCSPResponse records.
>
> For backward compatibility, clients supporting both this new mode and the
> old one, so that they can use the old mode with servers that only support
> that mode, will have to send two CertificateStatusRequest extension in the
> ClientHello, one for the "ocsp" type, and one for the "ocsp_multi" type.
>

Is it worthwhile for clients to be backwards compatible?  How wide is
server support for status_request?  I can help gather this data if it
would help make a decision, though I am in favor of ocsp_multi
regardless (as opposed to a new extension).

- nagendra