A CA may specify that an OCSP client can trust a responder for the lifetime of the responder's certificate. The CA does so by including the extension id-pkix-ocsp-nocheck. This SHOULD be a non-critical extension. The value of the extension should be NULL. CAs issuing such a certificate should realize that a compromise of the responder's key is as serious as the compromise of a CA key used to sign CRLs, at least for the validity period of this certificate. CA's may choose to issue this type of certificate with a very short lifetime and renew it frequently.
id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }
Extension
| Modifier and Type | Field and Description |
|---|---|
| public static final String |
| Access | Constructor and Description |
|---|---|
| public | |
| public | OCSPNoCheckExtension(Boolean
true if the extension is to be treated as critical. critical, Object an array of DER encoded bytes of the actual value. value)Create the extension from the passed DER encoded value. |
| Modifier and Type | Method and Description |
|---|---|
| public String |
| NAME | back to summary |
|---|---|
| public static final String NAME | |
| OCSPNoCheckExtension | back to summary |
|---|---|
| public OCSPNoCheckExtension() throws IOException Create a OCSPNoCheckExtension | |
| OCSPNoCheckExtension | back to summary |
|---|---|
| public OCSPNoCheckExtension(Boolean critical, Object value) throws IOException Create the extension from the passed DER encoded value.
| |
| getName | back to summary |
|---|---|
| public String getName() Overrides sun. Return the name of this extension.
| |