Re: cvs commit: openssl/crypto/ocsp ocsp.h ocsp_err.c ocsp_vfy.c

[rsalz]

I think Oscar's a bit confused.  Richard wants to say
        This is the cert of the OCSP responder I trust
and that *is all* he wants to say.  He does not want/need to verify the
chain of certs from the responder.  (It could be self-signed, it
could be he has out of band information, etc.)  In my experiences,
Richard's use model is the most common method of OCSP deployments.
Stephen's comments about adding the CA to the trust list are a bit
worrisome.
        /r$
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]