I'm trying to decide on a certificate revocation strategy for a solution I'm designing (that will utilize Dogtag PKI, per customer request). The obvious choices seem to be using a CRL or using OCSP. I'm trying to understand the practical implications of both, and select one that can support this particular solution.
I think the primary gotcha here is that while clients will have occasional network access to the PKI infrastructure, they will also need to operate in an isolated lan capacity. In this use case, two clients need to be able to authenticate each other directly (including a check for certificate revocation by a central authority) without access to e.g. an OCSP responder.
- Does one of these solutions (CRL/OCSP) lend itself better to cached/offline operation?
- Is it correct to characterize a CRL as a blacklist and OCSP as a whitelist (that could be cached locally, perhaps piecemeal for known peers)?
- Am I asking the wrong question? (Another suitable solution, perhaps, or another angle to approach the problem?)