Subject: SCVP Questions

From: "Faisal" <[email-masked]>
Date: Tue, 1 Jul 2003 17:35:50 +0500

Hi,

    Following things are not clear to me, can any one please do clear these:
  1.. If SCVPServer goes for revocation checking of QuriedCertificate and did not find valid revocation information about certificate from local repository and problem to connect ldap with reason that ldap is not responding or temperaly off and same with ocsp too. In this case this should not called as Internal Error, so revocation status should be Unknown for the certificate.
  In this case SCVPServer has not any valid OCSPResponse or CRL related QuriedCertificate and in WantBack revocation information is required, so how we can handle this case?
  2.. If SCVPServer recieves a request with one certificate for query and found a CRL in which issuer of the certificate is revoked but query certificate is not revoked in that CRL, what would be the response of the quried certificate, either Revoked or Good or ?
  3.. If queried certificate is expired then what would be the response either Revoked or SCVPServer should process for revocation checking of the certificate?
  Also if on expired certificate SCVPServer should send back status as revoked then what would be the revocation information about Revoked status? because we have not checked any OCSPResponse or CRL for this condition.
There are more things but related above, may be your kind replies will do fix those automatically.

Thanks in advance for replies.
Regards,
Faisal Maqsood
www.ascertia.com

---

From: "Trevor Freeman" <[email-masked]>
Date: Tue, 1 Jul 2003 12:20:46 -0700

See below

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Faisal
Sent: Tuesday, July 01, 2003 5:36 AM
To: [email-masked]
Subject: SCVP Questions

Hi,

    Following things are not clear to me, can any one please do clear
these:

1.     If SCVPServer goes for revocation checking of QuriedCertificate
and did not find valid revocation information about certificate from
local repository and problem to connect ldap with reason that ldap is
not responding or temperaly off and same with ocsp too. In this case
this should not called as Internal Error, so revocation status should be
Unknown for the certificate.

[Trevor Freeman] If the ldap connection failed - unknown, if it
succeeded but unavailable.

In this case SCVPServer has not any valid OCSPResponse or CRL related
QuriedCertificate and in WantBack revocation information is required, so
how we can handle this case?

2.     If SCVPServer recieves a request with one certificate for query
and found a CRL in which issuer of the certificate is revoked but query
certificate is not revoked in that CRL, what would be the response of
the quried certificate, either Revoked or Good or ?

[Trevor Freeman] Revoked. The chain you describe would fail the
algorithm described in RFC3280 section 6.

3.     If queried certificate is expired then what would be the response
either Revoked or SCVPServer should process for revocation checking of
the certificate?

[Trevor Freeman] certPathNotValid

Also if on expired certificate SCVPServer should send back status as
revoked then what would be the revocation information about Revoked
status? because we have not checked any OCSPResponse or CRL for this
condition.

There are more things but related above, may be your kind replies will
do fix those automatically.

Regards,

Faisal Maqsood

www.ascertia.com