Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-8266

Possibility to issue a final OCSP responses with unlimited end date 99991231235959Z

    Details

    • Type: New Feature
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: EJBCA 7.2.1
    • Component/s: None
    • Provenance:
      Ordered by Customer
    • Issue discovered during:
      Customer
    • Sprint:
      EJBCA Team Bob - 2019 w28, EJBCA Team Bob - 2019 w31

      Description

      This is a compliance issue for eIDAS TSPs. ETSI EN 319 411-2 and -1

      https://www.etsi.org/deliver/etsi_en/319400_319499/31941102/02.02.02_60/en_31941102v020202p.pdf

      https://www.etsi.org/deliver/etsi_en/319400_319499/31941101/01.02.02_60/en_31941101v010202p.pdf

       

      319 411-2: CSS-6.3.10-09

      If OCSP is provided and the CA's certificate is about to expire, the TSP may compute a last OCSP answer for each and every issued certificate (whether revoked or not), with the "nextUpdate" field set to "99991231235959Z". 

       

      Today we can set OCSP Response validity in OCSP key binding really high, but it will not be set to a specific date 99991231235959Z.

      The easy fix is to put a check in OCSP response generation, if the nextUpdate is calculated to be >99991231235959Z, set it to 99991231235959Z. Then setting nextUpdate to 9999y (for example) will create this OCSP response.

      • modify OCSP response generation in OcspResponseGeneratorSessionBean
      • make JUnit test to verify both normal and final OCSP respose validity
      • update documentation for OCSP

       

       

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              katja_helmes Jekaterina Bunina
              Reporter:
              mikek Mike Agrenius Kushner
              Verified by:
              Margaret Thomas, Samuel Lidén Borell
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 1 day Original Estimate - 1 day
                  1d
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 day, 5 hours
                  1d 5h