Table of Contents
Advertisement
Netscape Recommendation
Netscape products do not currently examine this extension.
Microsoft Recommendation
Microsoft products do not currently examine this extension.
OCSPNocheck
OID
1.3.6.1.5.5.7.48.4
Reference
http://www.ietf.org/rfc/rfc2560.txt
Criticality
This extension should be noncritical.
Discussion
The extension is meant to be included in an OCSP responder's signing certificate.
The extension tells an OCSP client that the signing certificate can be trusted
without querying the OCSP responder (since the reply would again be signed by
the OCSP responder, and the client would again request the validity status of the
signing certificate). This extension is null-valued: its meaning is determined by its
presence or absence.
Since the presence of this extension in a certificate will cause OCSP clients to trust
responses signed with that certificate, use of this extension should be managed
carefully. If the OCSP signing key is compromised, the entire process of validating
certificates in the PKI will be compromised for the duration of the validity period
of the certificate. Therefore, certificates using
short lifetimes and be renewed frequently.
CMS Version Support
Refer to "OCSPNoCheckExt Plug-in Module" on page 217.
•
CMS 4.1: Not supported
•
CMS 4.2: Supported
•
CMS 4.2-SP2: Supported
•
CMS 4.5: Supported
•
CMS 6.0: Supported
Standard X.509 v3 Certificate Extensions
4.2.2.2.1
should be issued with
OCSPNocheck
Appendix C
Certificate and CRL Extensions
351
Advertisement
Table of Contents
