Previously when configuring a CS subsystem to perform ocsp checking based upon the AIA extension of each cert to be evaluated, the feature would only perform the desired ocsp check on the leaf cert and not the rest of the certificate chain.
This resulted in a possibly incomplete ocsp verification of a certficate and its chain. If a member of the chain had been revoked, the pki subsystem will still think the leaf cert is valid.
The resolution to this particular issue was to enhance the behavior of the ocsp checking in JSS for ONLY the AIA extension URL checking scenario. When AIA extensions are being consulted, the system has been enhanced to check the leaf cert and the cert chain for verification.
As a result, a full verification of a cetificate and its chain can be relied upon to have taken place correctly by interested parties.
This bug has been copied from bug #1666872 and has been proposed to be backported to 7.6 z-stream (EUS).
Marking the bug on Assigned state to fix the ocsp check problem reported by CC lab.
I tested this bugzilla on 10.5.9-13.el7_6
I followed steps (In #comment 4) which are mentioned by Jack
1. I could see the subsystems could hit the Internal OCSP.
2. If key archival is done then it should check the certificate against the CA/SubCA
3. As negative test cases, I revoked RootCA cert. And as expected it was not working.
Verifying this BZ.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.