Subject: OCSP response nextUpdate field

From: "Pérez Herrero, David Antonio" <[email-masked]>
Date: Tue, 7 Feb 2006 10:46:44 +0100

Hello world,

What must be the "nextUpdate" value in an ocsp response with "unknown" status (when the OCSP responder don't recognize the issuer CA)?

Thanks.
-------------------------------------------------------------------------------------------------------------------
Este correo electrónico y, en su caso, cualquier fichero anexo al mismo, contiene información de carácter confidencial exclusivamente dirigida a su destinatario o destinatarios. Queda prohibida su divulgación, copia o distribución a terceros sin la previa autorización escrita de Indra. En el caso de haber recibido este correo electrónico por error, se ruega notificar inmediatamente esta circunstancia mediante reenvío a la dirección electrónica del remitente. POR FAVOR, ANTES DE IMPRIMIR ESTE CORREO ELECTRÓNICO CONSIDERE SU APORTACIÓN A LA CONSERVACIÓN DEL MEDIO AMBIENTE POR LA REDUCCIÓN DE CONSUMO DE PAPEL.

The information in this e-mail and in any attachments is confidential and solely for the attention and use of the named addressee(s). You are hereby notified that any dissemination, distribution or copy of this communication is prohibited without the prior written consent of Indra. If you have received this communication in error, please, notify the sender by reply e-mail. PLEASE CONSIDER YOUR ENVIRONMENTAL RESPONSIBILITY BEFORE PRINTING THIS E-MAIL.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 7 Feb 2006 07:25:30 -0800

The standard (RFC 2560) is silent on this issue.  I doubt that "nextUpdate" field is processed by commonly used OCSP clients when the response is "unknown".

In order for Responder to assert a meaningful value, clients should be able to use it.  One cooperative agreement between the two could be that the Responder goes out and uses automated or manual means so often to find new CAs.  In that situation, the Responder could put the time when it will go out and establish agreements with new CAs.

This is based on the assumption that the "unknown" response was generated because CA is not known to the Responder.  I doubt many products work in a manner that this response is generated because the certificate serial number is not known to the CA or the Responder.

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of Pérez Herrero, David Antonio
Sent: Tuesday, February 07, 2006 4:47 AM
To: [email-masked]
Subject: OCSP response nextUpdate field

Hello world,

Thanks.