Filippo Biondi

Hi Tomas, thank you for your thorough reply. I see your points and they make sense. "Signing" is an expensive and risky operation and I do agree that OCSP has a safer approach to error messages, although RFC 6960 is relatively recent. Cheers, Filippo

Hi, in CmpMessageHelper.java the comment on the method createUnprotectedErrorMessage() states "Create an unsigned RFC 4210 error message as described in section 5.3.21". I can be wrong but the https://tools.ietf.org/html/rfc4210#section-5.3.21 claims that the "The CA MUST always sign it with a signature key" Is my understanding of the RFC 4210 wrong? Thank you very much, Filippo Biondi

Dancer plugin