X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
RFC 6960

Document Type RFC - Proposed Standard (June 2013; No errata)
Obsoletes RFC 2560, RFC 6277
Updates RFC 5912
Last updated 2013-06-06
Stream IETF
Formats plain text pdf html
Stream WG state WG Document
Consensus Unknown
Document shepherd No shepherd assigned
IESG IESG state RFC 6960 (Proposed Standard)
Telechat date
Responsible AD spt
IESG note Document Shepherd: Steve Kent (kent@bbn.com)
Send notices to pkix-chairs@ietf.org, draft-ietf-pkix-rfc2560bis@ietf.org
IANA IANA review state IANA - Review Needed
IANA action state RFC-Ed-Ack
Internet Engineering Task Force (IETF)                      S. Santesson
Request for Comments: 6960                                  3xA Security
Obsoletes: 2560, 6277                                           M. Myers
Updates: 5912                                        TraceRoute Security
Category: Standards Track                                      R. Ankney
ISSN: 2070-1721
                                                              A. Malpani
                                                         CA Technologies
                                                             S. Galperin
                                                                      A9
                                                                C. Adams
                                                    University of Ottawa
                                                               June 2013

                X.509 Internet Public Key Infrastructure
               Online Certificate Status Protocol - OCSP

Abstract

   This document specifies a protocol useful in determining the current
   status of a digital certificate without requiring Certificate
   Revocation Lists (CRLs).  Additional mechanisms addressing PKIX
   operational requirements are specified in separate documents.  This
   document obsoletes RFCs 2560 and 6277.  It also updates RFC 5912.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc6960.

Santesson, et al.            Standards Track                    [Page 1]
RFC 6960                        PKIX OCSP                      June 2013

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1. Introduction ....................................................4
      1.1. Requirements Language ......................................5
   2. Protocol Overview ...............................................5
      2.1. Request ....................................................5
      2.2. Response ...................................................6
      2.3. Exception Cases ............................................8
      2.4. Semantics of thisUpdate, nextUpdate, and producedAt ........9
      2.5. Response Pre-Production ....................................9
      2.6. OCSP Signature Authority Delegation .......................10
      2.7. CA Key Compromise .........................................10
   3. Functional Requirements ........................................10
      3.1. Certificate Content .......................................10
      3.2. Signed Response Acceptance Requirements ...................10
   4. Details of the Protocol ........................................11
      4.1. Request Syntax ............................................11
           4.1.1. ASN.1 Specification of the OCSP Request ............11
           4.1.2. Notes on OCSP Requests .............................13
      4.2. Response Syntax ...........................................14
           4.2.1. ASN.1 Specification of the OCSP Response ...........14
           4.2.2. Notes on OCSP Responses ............................16
                  4.2.2.1. Time ......................................16
                  4.2.2.2. Authorized Responders .....................16
                           4.2.2.2.1. Revocation Checking of
                                      an Authorized Responder ........17
                  4.2.2.3. Basic Response ............................18
      4.3. Mandatory and Optional Cryptographic Algorithms ...........19

Santesson, et al.            Standards Track                    [Page 2]
RFC 6960                        PKIX OCSP                      June 2013
Show full document text