Specify allowed usage of "unknown" OCSP response

[wthayer]

RFC 6960 section 2.2 describes a limited situation in which the "unknown" response is expected to be returned for a certificate, but it is a SHOULD. There appear to be no hard and fast rules on when this response is forbidden, but multiple discussions [1][2][3] have resulted in the understanding that it is not generally acceptable. My understanding (to be confirmed) is that Firefox treats this response as a soft failure, which makes its use a risk. Consider banning the use of the "unknown" OCSP response.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1551390
[2] https://groups.google.com/d/msg/mozilla.dev.security.policy/LC_y8yPDI9Q/NbOmVB77AQAJ
[3] https://groups.google.com/d/msg/mozilla.dev.security.policy/hJGY5U-0bYI/K-emAMXVAQAJ

[dzacharo]

Dear Wayne,

According to section 2.2 of RFC 6960, an OCSP responder may respond "revoked" for a "non-issued" Certificate. It even allows this response for "unknown" Certificates in order to support backwards compatibility with implementations of RFC 2560.

In addition to that, section 4.4.8 labeled "Extended Revoked Definition" says:

"This extension MUST be included in the OCSP response when that response contains a "revoked" status for a non-issued certificate".

Also, from section 2.2
When a responder sends a "revoked" response to a status request for a non-issued certificate, the responder MUST include the extended revoked definition response extension (Section 4.4.8) in the response, indicating that the OCSP responder supports the extended definition of the "revoked" state to also cover non-issued certificates. In addition, the SingleResponse related to this non-issued certificate:

1. the responder MUST include the extended revoked definition response extension
2. In addition, the SingleResponse related to this non-issued certificate:

• MUST specify the revocation reason certificateHold (6),
• MUST specify the revocationTime January 1, 1970, and
• MUST NOT include a CRL references extension (Section 4.4.2) or any CRL entry extensions (Section 4.4.5).

By reading the BRs (section 6.9.13), it is clear that TLS Certificates are not allowed to be "suspended". However, if an RFC 6960 compliant OCSP responder responds with "revoked" for an unknown serial number and then issues a certificate with the same requested serial number, it will later return a response "good". This seems to be an allowed practice therefore it should be OK for a responder to change a "revoked" status to "good". In addition to that, 6960 demands that for non-issued Certificates, the responder must use the revocationReason "certificateHold".

To summarize:

• The BRs reference RFC 6960
• The BRs forbid to have Certificates "suspended" (i.e. revocationReason certificateHold)
• revoked-for-unknown must contain the Extended Revoked extension, so a client knows that this was a response for a non-issued certificate.

Using the following practice as described in RFC 6960 should not be a violation of the BRs. That is, answering revoked where a pre-certificate has been issued but not the final certificate should be OK as long as the response contains the Extended Revoked extension and the revocationReason is certificateHold. With this practice, it is very clear that the final certificate has
not been issued, so would this be considered a violation of the Mozilla policy?

[sleevi]

Dimitris: All of this is being discussed on the list. Could I ask you to continue the discussion there so it doesn’t fragment?

[dzacharo]

I wasn't sure which thread I should post this. One is discussion about Digicert's incident and the other is discussing about Apple's :)
Wayne is also making changes to wiki pages so I was hoping to get his attention here.

Anyway, I think I will respond to the thread with the most recent response.

[sleevi]

https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg12599.html

[BenWilson-Mozilla]

Looking at the emails, it appears that CABF Ballot SC23v3 subsequently passed and BR 4.9.10 was amended to address OCSP for precertificates. However, I don't believe that we have fully addressed whether / to what extent "unknown" and other similar types of OCSP responses are allowed. I'm not sure where the email thread on m.d.s.p. picks this back up.