Ballot SC076v2: Clarify and improve OCSP requirements

Ballot overview

• Ballot: SC076v2 Clarify and improve OCSP requirements (Server Certificate Working Group)
• Purpose: Address confusion about reserved serials, OCSP responder authoritative response timing, and how OCSP requirements apply when a certificate does not contain an AIA OCSP URL.

Key changes proposed

• OCSP response timing: OCSP responses must be available within 15 minutes of signing a certificate containing an AIA OCSP URL.
• Remove reserved serial concept: The ballot removes the concept of a reserved serial entirely.
• Restructure OCSP requirements:
  • Move OCSP requirements into Section 4.9.9.
  • Leave Section 4.9.10 empty (described as intended to place requirements on relying parties, not on CAs).
  • Organize Section 4.9.9 into three clusters:
    • Definitions of validity interval, assigned, and unassigned.
    • Requirements on OCSP responders (apply only to responses from AIA OCSP URLs found in issued certs).
    • Requirements on OCSP responses (apply to all responses regardless of whether the certificate has an AIA OCSP URL).

OCSP status availability requirement (from the provided diff)

• Effective 2025-01-15: For the status of a Subscriber Certificate or its corresponding Precertificate, an authoritative OCSP response MUST be available starting no more than 15 minutes after the Certificate or Precertificate is first published or otherwise made available.

Ballot approval result (from the ballot page)

• Voting results show 20 Issuers voting YES, 0 NO, 0 ABSTAIN; 2 Consumers voting YES, 0 NO, 0 ABSTAIN.
• The ballot page states Bylaws Requirements were MET and the ballot current status is passed.