Standard X.509 v3 Certificate Extensions
Appendix
C
Certificate and CRL Extensions
351
Netscape Recommendation
Netscape products do not currently examine this extension.
Microsoft Recommendation
Microsoft products do not currently examine this extension.
OCSPNocheck
OID
1.3.6.1.5.5.7.48.4
Reference
http://www.ietf.org/rfc/rfc2560.txt
4.2.2.2.1
Criticality
This extension should be noncritical.
Discussion
The extension is meant to be included in an OCSP responder’s signing certificate.
The extension tells an OCSP client that the signing certificate can be trusted
without querying the OCSP responder (since the reply would again be signed by
the OCSP responder, and the client would again request the validity status of the
signing certificate). This extension is null-valued: its meaning is determined by its
presence or absence.
Since the presence of this extension in a certificate will cause OCSP clients to trust
responses signed with that certificate, use of this extension should be managed
carefully. If the OCSP signing key is compromised, the entire process of validating
certificates in the PKI will be compromised for the duration of the validity period
of the certificate. Therefore, certificates using
OCSPNocheck
should be issued with
short lifetimes and be renewed frequently.
CMS Version Support
Refer to “OCSPNoCheckExt Plug-in Module” on page 217.
•
CMS 4.1
: Not supported
•
CMS 4.2
: Supported
•
CMS 4.2-SP2
: Supported
•
CMS 4.5
: Supported
•
CMS 6.0
: Supported
Summary of Contents for Certificate Management System 6.01
Page 1: ...Plug Ins Guide Netscape Certificate Management System Version6 01 May 2002...
Page 10: ...10 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 62: ...Enrollment Forms 62 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 308: ...NTEventLog Plug in Module 308 Netscape Certificate Management System Plug Ins Guide May 2002...
