Hello.
Sorry for my english.

The way the OCSP manager obtains the CRLs is a nice feature, but it may lack flexibility.

The OCSP manager can use its internal database or use CRLs published to an LDAP directory. This is convenient because of the way the OCSP manager gets its CRLs.

If the OCSP manager uses its internal database, its stays PASSIVE and the database is update by configuring the publishing on the Dogtag CAs side.

But it conflicts with other CAs implementation, like Microsoft implementation. With Microsoft implementation, one can configure CRLs publishing to CDPs or Active Directory. And the Microsoft OCSP responder is ACTIVE to checks the status against CDPs or Active Directory.

So, the only way to use Microsoft CAs with Dogtag OCSP manager is to use an external LDAP directory. I have not test this solution, but it may be very difficult if Microsoft and Dogtag implementation do not share the same object definition for CRLs in the LDAP directory. Again, I have not yet test this solution.

A good solution may be to add the possibilty to the OCSP manager to checks CRLs against CDPs in an ACTIVE way. This way will avoid the burden to have an external LDAP directory.