205436 - Enhance NSS' OCSP client to talk to responders over HTTPS

Status: RESOLVED WONTFIX

(NSS :: Libraries, enhancement, P2)

Description

[Wan-Teh Chang]

It is useful to talk to an OCSP responder over HTTPS,
for example, for confidentiality reasons.  Right now
NSS can only talk to an OCSP responder over HTTP.

This may require the support of the id-pkix-ocsp-nocheck
cert extension, whcih suppresses the revocation checking
of the responder's cert.

Comment 1

[Ralf Hauser]

see also bug 92923 (duplicate?)

Comment 2

[Kai Engert [:KaiE:]]

*** Bug 92923 has been marked as a duplicate of this bug. ***

Comment 3

[Kai Engert [:KaiE:]]

I reopened bug 92923 and reverted my change, I believe it's not a duplicate.

This bug is about supporting OCSP to https *within* NSS.
NSS has an internal http client, and might choose to enhance that to support
https.

Wan-Teh, you might choose to set this bug to WONTFIX, if you think the internal http client should no longer be enhanced, but people should rather solve the problem in the external http client provided by the application.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Removing pkix from whiteboard.
This bug is not specifically about libpkix.  
It may be implemented as an enhancement to libpkix.

Comment 5

[Wan-Teh Chang]

Marked the bug WONTFIX.