On Tue, Mar 23, 2010, PGNet Dev wrote: > I'm planning to run openssl ocsp in server mode, > > openssl ocsp \ > -index /svr/demoCA/index.txt \ > -port 8888 \ > -CA /svr/demoCA/certs/CA/CA.cert.pem \ > -rsigner /svr/demoCA/crl/OCSP.cert.pem \ > -rkey /svr/demoCA/crl/OCSP.privkey.pem \ > -text -out /var/log/ocsp.log > > where "OCSP.cert.pem" is a single-purpose cert, only for the OCSP responder. > > What's the MINIMAL (Extended)KeyUsage for the cert? > > Currently, I have > > cat /svr/demoCA/crl/OCSP.cert.pem | grep -i usage -A1 > > X509v3 Extended Key Usage: > OCSPsigning > -- > X509v3 Key Usage: critical > Digital Signature, Non Repudiation, Key > Encipherment > > Obviously, the "OCSPsigning" Extended usage is required. > > Which, if any/all, of the "Digital Signature, Non Repudiation, Key > Encipherment" KeyUsage specifications are required, if this cert will > be used ONLY for/by the OCSP responder daemon? >
Well Key Encipherment is not required and there's the usual can of worms associated with the NR bit. I'd say just digital signature is sufficient. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
