[cabfpub] [cabfquest] Question concerning CAB Forum OCSP Requirments
geoffk at apple.com
Tue Oct 28 12:57:07 MST 2014
On 28 Oct 2014, at 2:40 am, Thomas Kopp <thomas.kopp at luxtrust.lu> wrote:
> Dear Ryan,
> Thanks for your explanation.
> However, we do understand why does CAB Forum imposes the “nocheck” for an authorized responder approach instead of leaving it at the CA’s discretion, as to whether they prefer covering OCSP responder certificates by a CRL or not?
You should not assume that client software will necessarily fall back to a CRL if the OCSP responder certificate has a self-signed OCSP response. Client software may simply decide the validation of the OCSP response has failed and either 'soft fail' (assume the original certificate is valid) or 'hard fail' (assume the original certificate is invalid).
In both cases, since the previous OCSP validation has failed, the OCSP responder will likely flush that response from its cache immediately, and then re-fetch it next time that certificate's validation is requested. Past (painful) experience shows this can lead to a 10x or more increase in load on the OCSP responder.
Alternatively, client software may assume that you meant to specify nocheck, and behave as if you did.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 4103 bytes
Desc: not available
Url : https://cabforum.org/pipermail/public/attachments/20141028/40b991da/attachment.bin
More information about the Public