Rich Salz wrote:
On Tue, 18 Mar 2003, [EMAIL PROTECTED] asked:
how does the CRL get from the CA to the OCSP responder
There is no single answer. Possibilities include: -A "publication" plugin for the CA that sends it to the OCSP responder -The CA publishes to LDAP and the OCSP responder polls for new CRLs -Revocation information is in the OCSP responder, it gives the CA a new CRL to sign periodically.
The problem here:
the master database containing the information about the revoced certificates is stored on a computer with direct connection to the
internet.
Could be an interesting point for hackers.
-CA and OCSP are a single integrated program.
CA on a server connected to the internet ? Augh.
Tschau
G�tz
-- Goetz Babin-Ebell, TC TrustCenter AG, http://www.trustcenter.de Sonninstr. 24-28, 20097 Hamburg, Germany Tel.: +49-(0)40 80 80 26 -0, Fax: +49-(0)40 80 80 26 -126
smime.p7s
Description: S/MIME Cryptographic Signature
