OCSP pkix-ocsp-no-check extension handling

[JeyJeyGao]

What is not working as expected?

notation-core-go/revocation/ocsp/ocsp.go

Lines 158 to 167 in 453a5eb

	// Handle pkix-ocsp-no-check and id-ce-invalidityDate extensions if present
	// in response
	extensionMap := extensionsToMap(resp.Extensions)
	if _, foundNoCheck := extensionMap[pkixNoCheckOID]; !foundNoCheck {
	// This will be ignored until CRL is implemented
	// If it isn't found, CRL should be used to verify the OCSP response
	_ = foundNoCheck // needed to bypass linter warnings (Remove after adding CRL)
	// TODO: add CRL support
	// https://github.com/notaryproject/notation-core-go/issues/125
	}

I think the OCSP implementation is not quite right. The pkix-ocsp-no-check extension should be part of the certificate rather than the OCSP response.

References:

• https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/implementing-an-ocsp-responder-part-ii-preparing-certificate/ba-p/396524
• https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2.1

What did you expect to happen?

No

How can we reproduce it?

No real effect.

Describe your environment

Source code

What is the version of your notation-core-go Library?

v1.1.0-rc.1

[github-actions]

This issue is stale because it has been opened for 60 days with no activity. Remove stale label or comment. Otherwise, it will be closed in 30 days.