<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Ken,</div><div class=""><br class=""></div><div class="">Note that OCSP for root CAs like yours is only required to refresh the responses once every twelve months, when things are going well. This is the same frequency as CRL updates. It is entirely possible to sign the OCSP responses during the same ceremony where you sign the CRLs or new subordinates and then just serve those as static files. CA/B Forum does not require the OCSP responder to support nonces so dynamic response generation is not a requirement.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Peter</div><br class=""><div><blockquote type="cite" class=""><div class="">On Jan 15, 2016, at 9:51 AM, Myers, Kenneth (10421) <<a href="mailto:kenneth.myers@protiviti.com" class="">kenneth.myers@protiviti.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a name="_MailEndCompose" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Hi Jeremy,<o:p class=""></o:p></span></a></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The use case is a Root CA that issues long term CA certificates to a limited number of organizations who operate their own issuing CAs independent from the same infrastructure of the root.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">For example, the Federal Government operates a Trust Anchor and issues 10 year subordinate certificates to a limited number of agencies (around 10). Those organizations operate their own intermediate and issuing CAs. The issuing CAs are required to have OCSP. All operate under the same CP but have different organizational CPS. OCSP is not a requirement of the root as long as we have a highly available HTTP CRL and because of the low issuance volume it is not big or will get big based on this model.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Ken<o:p class=""></o:p></span></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Jeremy Rowley [<a href="mailto:jeremy.rowley@digicert.com" style="color: purple; text-decoration: underline;" class="">mailto:jeremy.rowley@digicert.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Wednesday, January 13, 2016 21:43<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Peter Bowen <<a href="mailto:pzb@amzn.com" style="color: purple; text-decoration: underline;" class="">pzb@amzn.com</a>>; Ryan Sleevi <<a href="mailto:sleevi@google.com" style="color: purple; text-decoration: underline;" class="">sleevi@google.com</a>>; Myers, Kenneth (10421) <<a href="mailto:kenneth.myers@protiviti.com" style="color: purple; text-decoration: underline;" class="">kenneth.myers@protiviti.com</a>>; Ben Wilson <<a href="mailto:ben.wilson@digicert.com" style="color: purple; text-decoration: underline;" class="">ben.wilson@digicert.com</a>>;<span class="Apple-converted-space"> </span><a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>RE: [cabfpub] OCSP Requirement for Root CA<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">That’d be interesting. Is there a use case for it?<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I don’t see any reason it couldn’t be done that way assuming you still have an OCSP response that complies with 4.9.10.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span><a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class="">public-bounces@cabforum.org</a><span class="Apple-converted-space"> </span>[<a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class="">mailto:public-bounces@cabforum.org</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Peter Bowen<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Wednesday, January 13, 2016 1:49 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Ryan Sleevi; Myers, Kenneth (10421); Ben Wilson;<span class="Apple-converted-space"> </span><a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] OCSP Requirement for Root CA<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Jan 13, 2016, at 10:15 AM, Ryan Sleevi <<a href="mailto:sleevi@google.com" style="color: purple; text-decoration: underline;" class="">sleevi@google.com</a>> wrote:<o:p class=""></o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Wed, Jan 13, 2016 at 10:03 AM, Ben Wilson <<a href="mailto:ben.wilson@digicert.com" target="_blank" style="color: purple; text-decoration: underline;" class="">ben.wilson@digicert.com</a>> wrote:<o:p class=""></o:p></div><div class=""><div class=""><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Is the requirement really clear? Some browsers don't check OCSP for intermediates and use CRLs instead. <o:p class=""></o:p></div></blockquote><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">So? The BRs themselves are clear it's a requirement. I mean, if we want to change to discuss that practical reality, we certainly can, but we should at least honor the rules as written.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Section 4.9.10 makes that clear. 7.1.2.2 item c also makes this clear.<o:p class=""></o:p></div></div></div></div></div></blockquote><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">It seems pretty clear to me. <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class=""> </span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">If a CA signs a certificate with CA:True in basicConstraints, then it must issue CRLs.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class=""> </span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">If a CA issues certificates covered by the BRs (either subscriber certificates or CA cross-certificates), then it must have an associated OCSP responder.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class=""> </span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">I think it is allowable that a CA that issues both kinds of certs (subscriber and CA) can issue CRLs with an IDP extension that indicates that the CRL only covers CA certs.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class=""> </span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">Does this sound right?<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class=""> </span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">Thanks,<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-family: Arial, sans-serif; color: rgb(34, 34, 34);" class="">Peter</span></div></div></div></div></div></blockquote></div><br class=""></body></html>