Understanding the roles involved is essential for designing a public key infrastructure.
The term "public key infrastructure" encompasses much more than the technical components and is often used in a misleading way.
In summary, a public key infrastructure is both an authentication technology and the totality of all the components involved.
Certificates usually have a "CRL Distribution Points" extension that tells an application where the certificate's associated certificate revocation list (CRL) can be found.
This is like a telephone directory: It contains all the serial numbers of certificates that have been revoked by the certification authority (and are still within their validity period). Every application that checks the revocation status must download and evaluate the entire certificate revocation list.
As the size increases, this procedure becomes increasingly inefficient. As a rule of thumb, 100,000 revoked certificates already correspond to approx. 5 MB file size for the certificate revocation list.
The Online Certificate Status Protocol (OCSP) was developed for this purpose (under the leadership of ValiCert): It is similar to a directory assistance service where applications can request the revocation status for individual certificates, thus eliminating the need to download the entire CRL. OCSP is specified in RFC 6960 .
Continue reading "Basics: Online Responder (Online Certificate Status Protocol, OCSP)"
If a revocation configuration is configured for an Online Responder, there are various setting options that are discussed below.
With regard to the design of the infrastructure for providing revocation information - i.e. the CRL distribution points (CDP) as well as the Online Responders (Online Certificate Status Protocol, OCSP) - the question arises whether these should be "secured" via Secure Sockets Layer (SSL) or Transport Layer Security (TLS).
The Microsoft certification authority always signs certificates with the key belonging to the most recent certification authority certificate. According to RFC 6960 , however, the signing certificate for an OCSP response should be signed by the same key as the certificate to be checked:
The CA SHOULD use the same issuing key to issue a delegation certificate as that used to sign the certificate being checked for revocation.
However, if the certification authority certificate is renewed and a new key pair is used in the process, it is necessary for the Online Responder to continue to maintain valid signing certificates for the certificates issued with the previous certification authority certificate, since these are still valid after all and must be checked for revocation.
Continue reading "Allow requesting a specific signature key on a certification authority"