Your scenario can be true.
Note that CRL have "nextUpdate" field, to give a hint when
to look for updates. OCSP has thisUpdate, nextUpdate, and producedAt
to give the client similar hints.
If you have the option, build your system so that the OCSP server
holds the revocation information, and periodically generates a CRL
for the CA to sign.
/r$
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
