Shammer's Philosophy

My private adversaria

CRL vs OCSP

I investigate a little about certificates information generated by DigiCert which supports OCSP in the past, the article is OpenSSLのOCSPはURLEncodeされたOCSPリクエストを処理できない?その2 - Shammerism.
And I failed enabling OCSP Stapling at my easy test, that test summary is First try OCSP Stapling on Debian Jessie but failed - Shammerism.
Then, I will check the DigiCert certificates to enable OCSP in my own CAs using for my test.
DigiCert certificates gotten from revoke.badssl.com includes AIA and CRL Distribution Points.

X509v3 CRL Distribution Points: 
    Full Name:
        URI:http://crl3.digicert.com/ssca-sha2-g5.crl
    Full Name:
        URI:http://crl4.digicert.com/ssca-sha2-g5.crl
...
Authority Information Access: 
    OCSP - URI:http://ocsp.digicert.com
    CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt

I recognize that certificates enabled OCSP should include AIA.
But both AIA and CRL Distribution Points are included according to the certificate of https://revoke.badssl.com.
I'm not familiar with if CRL Distribution Point is required for OCSP.

Checking about this point and I found Certificate Revocation (CRL vs OCSP).
According to thi site, CRLs might contain a lot of serial numbers and clients always have to download when checking server certificates if clients use CRL to check whether server certificates are revoked or not.
If the CRL would contain a lot of serials, it is not reasonable. A client requires only 1 serial but has to download a big CRL to check that only one serial would be included in the CRL.
But OSCP is sending a request with the serial which client would like to check the revoked status for OCSP Responder, this URL is AIA.
CRL Distribution Point is not regardless OCSP, though it is not bad including both of them because some of clients might not support OCSP.

OCSP is not a new solution but not used for a long time in my impression. But, it would be started to use.