Re: technical question about RFC 6960

On Tue, Apr 28, 2020 at 11:17 PM Tom Hans <[email protected]> wrote:
>
> Hello,
>
> thank you for your answers.
>
> I know that the OCSP response cannot be validated because I do not have the Root CA B installed.
> If I do this the response is validatable.
>
> What I like to know is if this is RFC conform?
> In RFC 6960 section 4.2.2.2. there are mentioned the following three possibilities:
>
>    1. Matches a local configuration of OCSP signing authority for the
>       certificate in question, or
>
>    2. Is the certificate of the CA that issued the certificate in
>       question, or
>
>    3. Includes a value of id-kp-OCSPSigning in an extended key usage
>       extension and is issued by the CA that issued the certificate in
>       question as stated above.
>
>
> Point 2 and 3 are not used because the certificate in request is issued by Root CA A and point one is not really clear for me.

There are two different architectures here.  Points two and three
cover "first party" status checking - asking the issuer of the
certificate or someone authorized by the issuer to tell you the
status.  Point on covers "third party" status checking - asking an
unrelated party about the certificate.

Comparing this to the process of driver's licenses in the US, you can
ask the state government department or agency that issues licenses
about the status of a license.  That is point 2.  You could also ask a
police department about the license and also ask the police for a
certificate that they are authorized to provide license status.  That
is point 3.  However a license is also frequently used as
identification.  A private club could have a membership list.  You
could ask the club secretary whether license matches someone on the
membership list.  It doesn't necessarily tell you that the person is
authorized to drive a car, but they can tell you if the person is
authorized to enter the clubhouse.  That is point 1.

You hit a OCSP responder that is covered under point 1.  Unless you
have out of band knowledge that the answers it is providing are
relevant to your use case, then having B tell you about status of
things A issues probably is not what you want.

Thanks,
Peter