Online Certificate Status Protocol (OCSP) Extensions to IKEv2
draft-myers-ikev2-ocsp-05

[Ballot discuss]
> The sender of an OCSP request CERTREQ SHOULD accept an IKEv2 exchange
> if a corresponding OCSP response CERT payload is not received.  This
> might be an indication that this OCSP extension is not supported.  In
> this case, the peer SHOULD attempt to determine certificate
> revocation status by some other means.

This appears something that should rather be configurable.
If the policy of the sender is that it must be able to run
OCSP, this document should not prevent it. Suggested edit:

Note that the lack of an OCSP response CERT payload
after sending an OCSP request CERT payload might
be an indication that this OCSP extension is not
supported. As a result, it is recommended that
nodes be configured to require a response only if
it is known that all peers do in fact support this
extension. Otherwise, it is recommended that the
nodes be configured to try OCSP and, if there is
no response, attempt to determine certificate
revocation status by some other means.

> 5.2.  Extended Authentication Protocol (EAP)

This section should clearly state that the OCSP
is used for the cert status check of the server
side IKEv2 cert (and not, say, for the cert
status check of either the EAP peer or server).

> Note that while [IKEv2] allows for the optional
> inclusion of a CERTREQ in (2), this document asserts no need of its
> use.  It is assumed that environments including this optional payload
> and yet wishing to implement the OCSP extension to IKEv2 are
> sufficiently robust as to accommodate this redundant payload.

Is there a rationale for the existence of this CERTREQ
payload? If not, perhaps we should simply deprecate
it here. If yes, it may be inappropriate for the OCSP
document to state anything about this payload -- remember
that there are other payload types than 14.

IANA Last Call Comments:

Upon approval of this document, the IANA will make the following
assignment in the IKEv2 Certificate Encodings registry located at:

http://www.iana.org/assignments/ikev2-parameters

Value Certificate Encoding
-------- ------------------------------
14 OCSP Content

We understand the above to be the only IANA Actions for this document.