Re: OCSP Checking for certificates without AIA URLs

Hey Dan,

There is nothing in Firefox to support this use case.  The live OCSP
checking code [1] (vs. stapled) pulls the OCSP responder URL from AIA at
validation time; there is no other way to configure a responder URL.

--Richard

[1]
http://searchfox.org/mozilla-central/source/security/certverifier/NSSCertDBTrustDomain.cpp#518
http://searchfox.org/mozilla-central/source/security/certverifier/NSSCertDBTrustDomain.cpp#565

On Mon, Oct 17, 2016 at 12:10 PM, Dan Bryan <[email protected]> wrote:

> Hello,
> In a PKI where there are multiple private CA's that do not publish
> revocation urls into the certificates AIA field, what options does Firefox
> provide for using a 3rd party revocation service who has been delegated as
> an OCSP authority for these CAs.
> I would like to be able to say Private CA1-3 should query responder
> http://ocsp1.com and Private CA4-5 should query http://ocsp2.com. This
> flexibility has been offered in CAPI via group policy certificate
> properties since vista. But being that firefox doesn't depend on CAPI for
> certificate validation, is there anyway to configure NSS to support
> something like this?
>
> Thanks,
>
> --Dan
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security
>