Subordinate CA OCSP validity limits

[Taavi Eomäe]

Hi,

The S/MIME BR (1.0.12) currently defines OCSP response validity periods for subscriber certificates.

However quite a few CAs also offer OCSP for their subordinate CAs, the BR defines how often (12mo) and how fast (within 24h) the status should be updated, but not how long the responses should be valid.

Is this intentional? Should an implementation only enforce an upper limit of 12 months?


Best Regards,
Taavi Eomäe
Zone Media OÜ

[Stephen Davidson]

Hello Taavi

 

This OCSP language is consistent in several of the CABF standards.

For sub CAs, that is the only specification.  CAs are free to implement tighter boundaries, but this is the minimum.

 

Regards, Stephen

--
You received this message because you are subscribed to the Google Groups "S/MIME Certificate WG - Public (CA/B Forum)" group.
To unsubscribe from this group and stop receiving emails from it, send an email to smcwg-public...@groups.cabforum.org.
To view this discussion visit https://groups.google.com/a/groups.cabforum.org/d/msgid/smcwg-public/90ac33f2-3eb9-417a-81e3-3a2a059b37f6n%40groups.cabforum.org.