Should response signature validation be optional about stapled

[jsha]

Note: some of this would be solved by implementing the issuer cache and putting "fetch issuer" in updateResponse instead of at startup. Then you'd only need the ignore-signature-validation flag for certificates that (a) don't have AIA, and (b) don't have a local copy of the issuer certificate. Since you would need (b) to serve the cert anyhow, you can probably punt on the config flag altogether.

Note that you will also have a case where AIA is present, but the fetch fails. Probably that should be considered the same as a failure to fetch or parse the OCSP response itself.

[cpu]

Is there a good use-case for serving an OCSP response when the daemon can't check its signature?

My gut instinct is that it could be a foot-gun option someone would be tempted to turn on as a quick fix to a problem better addressed other ways.

[jsha]

Is there a good use-case for serving an OCSP response when the daemon can't check its signature?

I think not.

[rolandshoemaker]

My gut instinct is that it could be a foot-gun option someone would be tempted to turn on as a quick fix to a problem better addressed other ways.

Agreed.

Is there a good use-case for serving an OCSP response when the daemon can't check its signature?

I think not.

Agreed, closing.