Subject: RE: OCSP Service Locator and RFC2459's Authority Information Acce ss

From: Michael Myers <[email-masked]>
Date: Wed, 3 Mar 1999 16:00:33 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> 
> This brings up a new question: why is there no OCSP AIA 
> AccessDescription
> defined?  :) All we need is an OID and a URIName of type 
> IA5STRING.  Is it
> too late to add this to the current draft?  Does it belong 
> here, or does it
> more like a cert profile item?  Because of its "dual nature" should it
> perhaps
> be written up separately, anyway? (Probably not, since the 
> OID base will end
> up

Rick,

It's already in there:

"4.1  Certificate Content

   In order to convey to OCSP clients a well-known point of information
   access, CAs SHALL provide the capability to include the
   AuthorityInfoAccess extension (defined in [PKIX1], section 4.2.2.1)
   in certificates that can be checked using OCSP.  Alternatively, the
   accessLocation for the OCSP provider may be configured locally at the
   OCSP client.

   CAs that support an OCSP service, either hosted locally or provided
   by an Authorized Responder, MAY provide a value for a
   uniformResourceIndicator (URI) accessLocation and the OID value id-
   ad-ocsp for the accessMethod in the AccessDescription SEQUENCE.

   The value of the accessLocation field in the subject certificate
   defines the transport (e.g. HTTP) used to access the OCSP responder
   and may contain other transport dependent information (e.g. a URL)."

Mike

---

From: [email-masked]
Date: Wed, 3 Mar 1999 19:10:49 -0500

>It's already in there.

Oops.

Two reading mistakes in two days.  Mea culpa.