Hi Stephen, true. But there might be issues with handling the trust anchors when the service is outsourced, behind a load balancing server, or simply when the https cert is not the same as the ocsp one (how to verify that one via the ocsp ?). As a result, AFAIK, many current OCSP servers are over HTTP, not HTTPS (just checking the URLs embedded in certificates...) HTTPS is a good point.. but currently under-deployed.. that's why I am rising the point... Later, Max On 11/16/2009 12:08 PM, Dr Stephen Henson wrote:
Would've thought an https URL for the responder would be a simpler way.
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.