1093305 - only accept critical id-pkix-ocsp-nocheck extension in certificates being verified in an OCSP context

Status: NEW

(Core :: Security: PSM, defect, P3)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Bug 1079658 adds "support" for id-pkix-ocsp-nocheck by essentially ignoring it (particularly when marked critical, which would previously cause failures with an unknown critical extension error).

(Brian Smith (:briansmith, :bsmith, use NEEDINFO?) from bug 1079658 comment #4)
> One thing to consider is whether the presence of this extension in a
> non-OCSP context (when requiredEKUIfPrresent != id_kp_OCSPSigning ||
> endEntityOrCA != EndEntityOrCA::EndEntity) should be considered an error.

In this bug, we can explore this possibility and do it if it's a good idea.