Please imagine an architecture with a root certificate authority (CA) and a subordinate CA.
Is it possible for a client:
- to connect to an https server
- verify the validity of the server's certificate with ocsp stapling and the first CA (the one who issued the certificate)
- then check for no-revocation of the certificate of the first CA with CRL (certificate revocation list)?
In summary, is it possible to combine ocsp stapling and CRL consultation?
The use case is if the root CA is off (best practices) or multi stapling is impossible.
Thank you so much!