943651 - Add support for the PreferredSignatureAlgorithms OCSP request extension

Status: NEW

(NSS :: Libraries, enhancement, P5)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

For compatibility reasons, we have to assume that the OCSP responder that we're sending an OCSP request to can only understand SHA-1 hashes in the OCSP request. RFC 6990 sectoin 4.4.7 defines an OCSP request extension wherein the OCSP request can indicate that the client supports/prefers additional signature algorithms.

As the RFC indicates, the OCSP responder can usually just assume that the client can verify signatures on OCSP responses that are of the same algorithm used to sign the certificate that the OCSP response is for, but this doesn't help the OCSP responder decide what signature algorithm to use for successful Unknown responses.