<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
On 10/30/2012 01:22 PM, From Yngve Nysaeter Pettersen:
<blockquote cite="mid:op.wmzojldmvqd7e2@damia.oslo.osa" type="cite">
<pre wrap="">1. Allow "revoked" response for a certificate that has not been "revoked"
but where that OCSP responder for any other reason knows the certificate
to be "bad".
2. Require that the OCSP responder MUST respond "good" in this situation.
3. Neither 1 or 2 (motivate).
</pre>
</blockquote>
<br>
Neither - an OCSP responder should respond with "Unknown" or
"Unauthorized" in case the certificate is unknown. Or either "Good"
or "Revoked" for known ones.<br>
<br>
Rational - responding "Revoked" for a certificate that might be
good, is incorrect, either due to migration and update time or other
reasons (out-of-sync cor whatever). Clients may cache revoked
responses forever, revoked certificates are never unrevoked.<br>
<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
</body>
</html>