diff options
| author | Martin Willi <martin@revosec.ch> | 2014-03-25 14:34:58 +0100 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2014-03-31 14:40:33 +0200 |
| commit | 91d71abb16a9b15bbcd7f6cbefb806408be3b92d (patch) | |
| tree | 78316a3926aeef1358ad770fee3401fc56af7fa7 /scripts/crypt_burn.c | |
| parent | a844b6589034ff53e845fb9013d69dac02385453 (diff) | |
| download | strongswan-91d71abb16a9b15bbcd7f6cbefb806408be3b92d.tar.bz2 strongswan-91d71abb16a9b15bbcd7f6cbefb806408be3b92d.tar.xz | |
revocation: Restrict OCSP signing to specific certificates
To avoid considering each cached OCSP response and evaluating its trustchain,
we limit the certificates considered for OCSP signing to:
- The issuing CA of the checked certificate
- A directly delegated signer by the same CA, having the OCSP signer constraint
- Any locally installed (trusted) certificate having the OCSP signer constraint
The first two options cover the requirements from RFC 6960 2.6. For
compatibility with non-conforming CAs, we allow the third option as exception,
but require the installation of such certificates locally.
Diffstat (limited to 'scripts/crypt_burn.c')
0 files changed, 0 insertions, 0 deletions