Subject: Ocsp Responder and AuthorityInfoAccessSyntax Question

From: carol <[email-masked]>
Date: Thu, 29 Aug 2002 9:16:26 +0800

Hello everybody,

   In our CA system, their are several ocsp responders. One can ask two ocsp responders
   for the status of a certficate, for example http://global and http://local . 
   In such situation, what should be the AuthorityInfoAccess extension like?

   case 1: only one AccessDescription node in AuthorityInfoAccessSyntax

     AccessMethod  : id-at-ocsp
     AccessLocation(URI): http://global;http://local
   
   case 2: set two  AccessDescription nodes in AuthorityInfoAccessSyntax
     AccessMethod  : id-at-ocsp
     AccessLocation(URI): http://global

     AccessMethod  : id-at-ocsp
     AccessLocation(URI): http://local

   Which of the above is more preferable? Or is there any standard/suggestion
   for such situation?

   Thanks a lot for any answer.

 wcarol

---

From: Sam Schaen <[email-masked]>
Date: Wed, 28 Aug 2002 21:53:34 -0400

We've been wrestling with this same problem for the large U.S. DOD PKI, where the number of
responders could number in the hundreds.  Our current planned approach is to not use AIA,
but instead use the option of local configuration in the client to point to an optimal
responder.

I believe in your case 2, http://local would be used only when http://global was
unavailable.  I'm not sure your case 1 is a legal syntax.

It might also be possible to use a load balancer solution where the URI in the AIA is a
virtual name translated by the load balancer to your http://global and http://local URIs.

Sam Schaen