security - Why aren't OCSP error messages signed?

Question

I'm trying to understand OCSP. I almost read the entire RFC but I'm not understanding why error message are not signed. The issues are obviously: If an error message isn't signed, a MiTM can simply deny the services replying client's requests with errors like unauthorized, internalError [...]

From RFC I can read:

In case of errors, the OCSP responder may return an error message. These messages are not signed.

without understanding why. Wouldn't be most secure with a sign? Maybe I'm missing the point there, but I think that it would be really more secure.

Answer 1

OCSP 客户端有兴趣验证证书吊销状态。返回状态的消息经过签名以避免流氓 OCSP 服务器返回虚假响应（例如，当实际状态为“撤销”时返回状态“良好”）。

当 OCSP 服务器指示证书的吊销状态未定义的错误时。OCSP 客户端应考虑拒绝此类证书或尝试通过 CRL 或其他 OCSP 服务器对其进行验证。或者，这可以在 OCSP 客户端上进行配置，让管理员决定。这与带有“未知”状态的已签名 OCSP 响应有关。