Allow requesting a specific signature key on a certification authority
The Microsoft certification authority always signs certificates with the key belonging to the most recent certification authority certificate. According to RFC 6960 , however, the signing certificate for an OCSP response should be signed by the same key as the certificate to be checked:
The CA SHOULD use the same issuing key to issue a delegation certificate as that used to sign the certificate being checked for revocation.
However, if the certification authority certificate is renewed and a new key pair is used in the process, it is necessary for the Online Responder to continue to maintain valid signing certificates for the certificates issued with the previous certification authority certificate, since these are still valid after all and must be checked for revocation.
Continue reading "Allow requesting a specific signature key on a certification authority"