About OCSP Services
168
Netscape Certificate Management System Administrator’s Guide • February 2003
How OCSP Services Work
An OCSP service works as follows:
1.
A CA is set up to issue certificates that include the Authority Information
Access Extension whose value identifies an OCSP responder that can be
queried for the status of the certificate.
2.
One or more CAs periodically publishes CRLs to an OCSP responder.
3.
The OCSP responder maintains the CRL it receives from the CA(s).
4.
An OCSP-compliant client verifies the status of a certificate by sending
requests containing all the information required to identify the certificate to the
OCSP responder for verification. The applications determine the location of the
OCSP responder from the value of the
Authority Information Access
Extension
in the certificate being validated.
5.
The OCSP responder determines if the request contains all the information
required by the responder to process it. If it does not, or if it is not enabled for
the requested service, a rejection notice is sent. If it does have enough
information, it processes the request and sends back a report stating the status
of the certificate. See “OCSP Responses,” on page 169 for details on the
responses sent by an OCSP service.
OCSP Response Signing
Every response that the client receives, including a rejection notification, is digitally
signed by the responder; the client is expected to verify the signature to ensure that
the response came from the responder to which it submitted the request. The key
the responder uses to sign the message depends on how the OCSP responder is
deployed in a PKI setup. RFC 2560 recommends that the key used to sign the
response belong to one of the following:
•
The CA that issued the certificate and whose status is being verified by the
responder.
•
A responder whose public key, which corresponds to the private key it uses to
sign responses, is trusted by the client. Such a responder is called a trusted
responder.
Summary of Contents for Certificate Management System 6.1
Page 1: ...Administrator s Guide Netscape Certificate Management System Version6 1 February 2003...
Page 28: ...Documentation 28 Netscape Certificate Management System Administrator s Guide February 2003...
Page 82: ...Uninstalling CMS 82 Netscape Certificate Management System Administrator s Guide February 2003...
Page 382: ...ACL Reference 382 Netscape Certificate Management System Administrator s Guide February 2003...
Page 794: ...Managing Certificates 794 Managing Servers with Netscape Console December 2001...
Page 810: ...The SSL Handshake 810 Managing Servers with Netscape Console December 2001...
Page 828: ...828 Netscape Certificate Management System Administrator s Guide February 2003...