OCSP Checking for certificates without AIA URLs
Dan Bryan <[email protected]> Mon, 17 Oct 2016 09:10:40 -0700 (PDT)
| Newsgroups | gmane.comp.mozilla.security |
|---|---|
| Message-ID | <[email protected]> |
Hello, In a PKI where there are multiple private CA's that do not publish revocation urls into the certificates AIA field, what options does Firefox provide for using a 3rd party revocation service who has been delegated as an OCSP authority for these CAs. I would like to be able to say Private CA1-3 should query responder http://ocsp1.com and Private CA4-5 should query http://ocsp2.com. This flexibility has been offered in CAPI via group policy certificate properties since vista. But being that firefox doesn't depend on CAPI for certificate validation, is there anyway to configure NSS to support something like this? Thanks, --Dan