<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
Thanks Corey,<br>
<br>
I reviewed that section before posting here. My recollection of this
requirement goes back to when it was introduced by Microsoft, under
Jody Cloutier. This requirement for "end-entities" was meant to
point to "Subscriber Certificates" which timestamping certificates
are not. Policy-wise, timestamping certificates are generally
treated as CA Certificates so the last sentence should apply to
them:<br>
<br>
<i>"All other certificate types must contain either an AIA extension
with an OCSP URL or a CDP extension with a valid CRL URL".</i><br>
<br>
Can our colleagues from Microsoft please clarify the intent of this
requirement?<br>
<br>
<br>
Thank you,<br>
Dimitris.<br>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 8/2/2021 5:18 μ.μ., Corey Bonnell
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DM6PR14MB21863E817C03B0DDA3CE0F89928F9@DM6PR14MB2186.namprd14.prod.outlook.com">
<pre class="moz-quote-pre" wrap="">Hi Dimitris,
I agree that the number of end-entity timestamp responder certificates
issued from a given timestamping ICA is generally low so CRLs should be of
reasonable size for direct consumption by client software. However, I want
to note that in addition to the section in the CSBRs that you noted,
Microsoft Root Program [1] requirement 3.A.5 specifies that all end-entity
certificates must contain an AIA OCSP pointer. Given this, the Microsoft
Root Program requirements will need to be relaxed for at least end-entity
timestamp responder certificates, in addition to any changes made in the
CSBRs.
Thanks,
Corey
[1]
<a class="moz-txt-link-freetext" href="https://docs.microsoft.com/en-us/security/trusted-root/program-requirements">https://docs.microsoft.com/en-us/security/trusted-root/program-requirements</a>
-----Original Message-----
From: Cscwg-public <a class="moz-txt-link-rfc2396E" href="mailto:cscwg-public-bounces@cabforum.org"><cscwg-public-bounces@cabforum.org></a> On Behalf Of Dimitris
Zacharopoulos (HARICA) via Cscwg-public
Sent: Monday, February 1, 2021 4:32 AM
To: <a class="moz-txt-link-abbreviated" href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a>
Subject: [Cscwg-public] Requirement for OCSP in Timestamping Certificates
According to the requirements, and section 13.2.1:
"CAs MUST provide OCSP responses for Code Signing Certificates and Timestamp
Certificates for the time period specified in their CPS, which MUST be at
least 10 years after the expiration of the certificate"
However, according to Certificate Consumer policies, either CRL or OCSP is
required to be used.
I would like to ask for Members to consider requiring either CRL or OCSP
information to be required in end-entity certificates used for
Time-stamping. The rationale is that Time-stamping Certificates are very few
compared to other end-entity certificates and CRLs should be considered
sufficient because their size is not significant.
Please let me know your thoughts, concerns or objections.
Thank you,
Dimitris.
_______________________________________________
Cscwg-public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Cscwg-public@cabforum.org">Cscwg-public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://lists.cabforum.org/mailman/listinfo/cscwg-public">https://lists.cabforum.org/mailman/listinfo/cscwg-public</a>
</pre>
</blockquote>
<br>
</body>
</html>