Policy OCSP Signing - OCSP 响应签名策略 —— 定义 OCSP 响应报文的签名校验规则与可信签名 CA 约束

Zurückkehren Übergeordnet: Cert Policy - 证书策略（CP）子树 —— 规定所签发证书的适用范围、安全要求与签发/续期/吊销/审计约束 (1.3.6.1.4.1.59719.5.1)

Technische Informationen

Punkt-Notation:	`1.3.6.1.4.1.59719.5.1.600`
ASN.1-Notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) pki-certificate-system(5) cert-policy(1) policy-ocsp-signing(600) }`
OID-IRI-Notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/PKICertificateSystem/CertPolicy/PolicyOcspSigning`
WEID-Notation:	`weid:P-1A2V-5-1-GO-8`
DER-Kodierung:	`06:0C:2B:06:01:04:01:83:D2:47:05:01:84:58`

Beschreibung

English:
Online Certificate Status Protocol (OCSP) response signing policy, which defines the signature verification rules for OCSP responses, including whether to verify the response signature, the trusted signer Certification Authority (CA) certificates and related validation constraints. Improper configuration may cause OCSP status query validation failure.
Recommended handling: confirm the trusted signer certificate of the OCSP responder and keep it consistent with the security policy requirements.
Status: registered but unused. No OCSP responder certificate has been issued under this policy; when activated, keep the responder certificate short lived and monitor it with 1.3.6.1.4.1.59719.0.3. The unused state shall be re-verified at each revision of this file.
Recommendation: prefer delegated OCSP responder certificates that carry the OCSP signing extended key usage, and never allow a responder certificate to be used for general server authentication.
See also: 1.3.6.1.4.1.59719.5.600, 1.3.6.1.4.1.59719.0.3.40, 1.3.6.1.4.1.59719.6.1.6.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
在线证书状态协议（Online Certificate Status Protocol，OCSP）响应签名策略，用于定义 OCSP 响应报文的签名校验规则，控制是否校验 OCSP 响应签名、可信签名证书颁发机构（Certification Authority，CA）及相关校验约束。配置异常会导致 OCSP 状态查询校验失败。
处理建议：确认 OCSP 响应服务端可信签名证书，并与安全策略要求保持一致。
状态：已注册但未使用。尚未按本策略签发任何 OCSP 响应证书；启用时应采用较短有效期，并用 1.3.6.1.4.1.59719.0.3 持续监控。本文件每次修订时须重新核验该未使用状态。
建议：优先使用携带 OCSP 签名扩展密钥用法的委派响应证书，且严禁将响应证书用于通用服务器认证。
关联节点：1.3.6.1.4.1.59719.5.600、1.3.6.1.4.1.59719.0.3.40、1.3.6.1.4.1.59719.6.1.6。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registrierungsstelle

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

Die Registrierungsstelle möchte ihre persönlichen Informationen nicht veröffentlichen.

Untergeordnete Objekte

ID	Base36	ASN.1 IDs (kommagetrennt)	IRI IDs (Kommagetrennt)	RA	Kommentar	Erstellt	Geändert
Keine Einträge vorhanden

Alternative Bezeichner

Bezeichner	Beschreibung
aid:D276000186B200054278A5EC78315B9A (Keine PIX erlaubt)	OIDplus Information Object Anwendungsbezeichner (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-5ecf7150df93	OIDplus Information Object Custom UUID (RFC 9562)
guid:ff0c2b06-13a1-345e-a45b-9a53adf92431	Namensbasierte Version 3 / MD5 UUID mit Namensraum UUID_NAMEBASED_NS_OID
guid:d68f595a-c304-53b5-90dc-2ca2bd7bda18	Namensbasierte Version 5 / SHA1 UUID mit Namensraum UUID_NAMEBASED_NS_OID
mac:32-65-F8-31-5B-9A	OIDplus Information Objekt Unicast MAC-Adresse (AAI)
mac:33-65-F8-31-5B-9A	OIDplus Information Objekt Multicast MAC-Adresse (AAI)
weid:P-1A2V-5-1-GO-8	WEID-Notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=2016500634	OIDplus Information Object X.500 DN