Re: new version trusted-proxy20 draft

On Wed, Feb 19, 2014 at 3:53 AM, Nicolas Mailhot <
nicolas.mailhot@laposte.net> wrote:

>
> Le Mar 18 février 2014 10:49, Salvatore Loreto a écrit :
> >
>
> > - if the question is how would be possible for the browser/client to run
> > OCSP  to check the validity of certificates from the CA if the OCSP is
> ran
> > over TLS
>
> When OSCP refers to an external validation server accessing it requires
> going through the proxy first...
>
> --


OCSP Stapling would be the answer here. (the proxy presents the OCSP
response as part of the TLS handshake.. it is still signed by the CA though
with a short lifetime - so the client doesn't need to go to the CA directly)