A question regarding certificate status service delegation
Thomas Kopp <[email protected]>
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Message-ID | <[email protected]> |
Dear all, According to RFC 5280, a certificate issuer can delegate CRL issuance to a different CA which may particularly be part of a different hierarchy than the one the certificate issuer belongs to (cf. the crlDistributionPoints extension, specifically sections 4.2.1.13 and 6.3.3. (b) 1) of the RFC). By contrast, in the case of OCSP delegation, it is required that an OCSP responder belongs to the same hierarchy like the certificate issuer (cf. section 2.6 of RFC 6960). Which is the motivation for this latter limitation? Is it just the lack of an OCSP-specific certificate extension that corresponds to the CRL-related crlDistributionPoints extension or are there any other reasons; if yes, which ones ? [LuxTrust_logo_blue_signature] Thomas KOPP Chief Scientist Email: [email protected]<mailto:[email protected]> Mobile:+352 621 229 316 Office: +352 26 68 15 - 574 LuxTrust S.A. | IVY Building | 13-15, Parc d'activités | L-8308 Capellen | Luxembourg | www.luxtrust.lu<http://www.luxtrust.lu/> _______________________________________________ pkix mailing list [email protected] https://www.ietf.org/mailman/listinfo/pkix
image002.png
(image/png, 6.7 KB) - not displayed