CAcert Code Development list.

[Michael Tänzer <michael.taenzer AT cacert.org>]

Hi guys,

Picking up the topic of building OCSP responders not directly operated
by CAcert using a cache of predistributed responses to compensate
failures of the main OCSP server:

We had some discussion in the Software Assessment Team about the
validity of the OCSP responses:
10 minutes is definitely too short, competitors range from 2 days to 7
days. So our recommendation is to use 2 days, (my personal opinion is
that 3 days might be acceptable too if we gain anything by that).

What OCSP responder software do we currently use?
The only thing I found that may be somewhat suitable is the OCSP
responder from EJBCA but even that one would require major adjustments
on our side (and it requires the bulky EJB) and I'm not sure whether the
additional OCSP responders are actually slaves and don't require an OCSP
cert of their own or if they are just additional OCSP servers. So maybe
there is no way around coding our own solution.

-- 
Have fun,
Michael Tänzer

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature