Subject: Re: [ntpwg] WG: I-D Action: draft-ietf-ntp-network-time-security-03.txt

From: Kurt Roeckx <[email-masked]>
Date: Sat, 5 Jul 2014 11:32:48 +0200

On Thu, Jun 26, 2014 at 03:36:41PM +0000, Stephen Röttger wrote:
> > > I tried to find out before how OCSP servers handle revoked but expired
> > > certificates. I couldn't find any specifics about this but I assume that
> > > they can purge their database and remove expired certificates from them
> > and
> > > then reply with 'certificate not revoked'.
> > > Does anyone know more about this?
> >
> > I think the best information for this is the CA/Browser forum
> > baseline requirements.  It has those section in it which I think
> > are relevant:
> > | 13.2.4 Deletion of Entries
> > | Revocation entries on a CRL or OCSP Response MUST NOT be removed
> > | until after the Expiry Date of the revoked Certificate.
> > [...]
> > | 13.2.6 Response for non-issued certificates
> > | If the OCSP responder receives a request for status of a
> > | certificate that has not been issued, then the responder SHOULD
> > | NOT respond with a "good" status. The CA SHOULD monitor the
> > | responder for such requests as part of its security response
> > | procedures.
> >
> > I assume that 13.2.6 applies to expired certificates too.
> >
> 
> I don't know how I could miss until now, but the OCSP RFC actually says
> that servers can send a 'good' response for revoked but expired
> certificates:
>   'The "good" state indicates a positive response to the status inquiry.
>    At a minimum, this positive response indicates that no certificate
>    with the requested certificate serial number currently within its
>    validity interval is revoked.  This state does not necessarily mean
>    that the certificate was ever issued or that the time at which the
>    response was produced is within the certificate's validity interval.'
> 
> So OCSP is not working for people who synchronize their time to a public
> server.

The RFS might not require it, but it's my understanding that the
CA/B forum requirements do.  Should we try to make CA/B forum
clarify it?

Kurt

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Kurt Roeckx <[email-masked]>
Date: Tue, 8 Jul 2014 20:16:54 +0200

On Mon, Jul 07, 2014 at 10:52:02AM +0000, Stephen Röttger wrote:
> Asking for clarification sounds good. Do you know how to contact them?

I've send them an e-mail.

Kurt