On Thu, Jul 2, 2020 at 9:36 AM Corey Bonnell <cbonn...@securetrust.com> wrote:
> (Sorry Ryan and Neil for the double-email, I accidentally omitted the list > on > the first email) > > > As others have rightfully pointed out, if the EKU is present, it is a > > delegated responder, full stop. > > For the certificate to be used as a delegated responder (as opposed to an > issuer of OCSP responder certificates), wouldn't they also need a keyUsage > value of digitalSignature? > No, this isn’t specified/required for Delegated Reaponders (at least, by 6960), and the client implementations I looked at did not check. I suspect you’re thinking about RFC 5280, Section 4.2.1.3’s normative requirement on the issuer of such certificates needing to include the KU? If so, that just seems to be arguing yet another way these certificates violate the requirements/profile. RFC 6960 is clear that the EKU indicates a designated responder, and you can’t “take back” that by suggesting the lack of the KU, as required by 5280, or the lack of nocheck, as required by the BRs, makes it “not a Responder”. It just makes it “not a correctly issued responder”. _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
