Question

I have the following question:
In security deployments what is the standard practice, if revocation checks are made to the certificates but for some reason at some specific moment it is not possible to determine the status of the target certificate?
E.g. because the network is down or the OCSP is down etc (any reason that essentially would not give a conclusive indication of what actually is the status of the certificate).
At first, I thought that the certificate should be considered as rejected (and for example drop the session).
On the other hand though, if I was a valid user and was denied access to resources, due to unrelated issues (such as network problems) I would not like it at all.
So I am not sure, what will happen here, will it depend per security environment, or is there actually some standard approach to handle this?

Any input is highly welcome.

Answer 1

Some systems cache revocation lists and/or revocation verification results for a fixed or configurable duration. Some request a user decision. Some do both (i.e.: request user decision only if cached result indicates certificate was not yet revoked).