Online Certificate Status Protocol (OCSP) is an IETF standard defined in RFC 2560 (http://www.ietf.org/rfc/rfc2560.txt). OCSP is used for real-time certificate status checking. OCSP uses HTTP as its transport mechanism. Transaction consists of an HTTP query using an HTTP POST verb and an HTTP 200 response.
1. OCSP request (MIME type: ocsp-request):
POST /ocsp HTTP/1.1
The request contains hash of the issuer's name and public key along with the serial number of the certificate to be validated:
2. OCSP response (MIME type: ocsp-response):
HTTP/1.1 200 OK
Expires: Mon, 22 Apr 2013 10:34:16 GMT
: Mon, 22 Apr 2013 08:59:16 GMT
Date: Mon, 22 Apr 2013 09:59:35 GMT
OCSP response contains the revocation status
To prevent spoofing attacks, the response is signed by the responder. In order to validate the signature, certificate containing public key of the responder is returned. This could lead to a problem whereby OCSP signing certificate revocation would be checked leading to a "verification loop". According to the RFC's 2560 section 220.127.116.11.1 there are three ways of overcoming this issue. Microsoft CA implementation uses special extension "id-pkix-ocsp-nochek". This extention tells the requester not to validate status of the OCSP signing certificate. The risk of the certificate being misused is mitigated by using very short certificate validity periods.
OCSP signing certificate:
Post a Comment