OCSP Requirements

1
OCSP Requirements

• GGF13

2
Refreshener

• OCSP Online Certificate Status Protocol
  (RFC2560)
• Removes(?) burden of CRL distribution and update
• Clients still have to do path validation!
• Lightweight request/response (HTTP)

3
Changes since last time

• Document finish applied
• Missing sections added
• Complete reformat
• Corrections based on (marginal) feedback
• Last week
• Additional comments from Spain

4
Updated architecture
CA
Periodic CRL download OCSP protocol
Push, Delta CRLs
site/organization boundary
CA
CA
CRLcache
OCSPcache
OCSPclient
AuthorizedResponder
CA
TrustedResponder
OCSP client
CA
CA
CA
CA
PMA
TrustedResponder
5
Outstanding issues

• Signed requests
• Stronger differentiation on suspension vs
  revocation
• Use of OCSP response extensions to convey
  additional (validation) information
• More wording on Delta CRLs
• Notion of a caution period (RFC3125)

6
Moving forward

• Address the Spanish contributions
• Move towards WG last call
• Have document in public comment before GGF14