openca/openca-ocspd — pull request #2 by vtsingaras (2014-09-19 13:40:52+00:00)
Title: Return unknown for un-issued certificates.

CA/B Forum guideline v1.1.9 (since v1.0.3) demands that an OCSP responder should not return GOOD to a request about an unrecognized serial. This patch implements that by logging the unknown serial and returning UNKNOWN to the client. The serials are provided by a file that is specified in the CA configuration. A timeout option is supplied to reload the file each 'timeout' seconds. The serials file must be plaintext with each serial in hex (w/o "0x") and delimited by "\n".