code review 11220043: go.crypto/ocsp: pass in the issuing certificate.

go.crypto/ocsp: pass in the issuing certificate.

Paul van Brouwershaven pointed out that it would be better to pass in
the issuing certificate and have the verification be done in the OCSP
package than to expect the caller to deal with the difference between
responses with and without a responder certificate.

[Paul van Brouwershaven, 2013-07-29 15:14:25]

I tested the OCSP lookup on every certificate in the chain for all major CA
public facing websites without running into any issues. Also CA's that don't
include a certificate in the OCSP response (the one that use the issuing
certificate for signing the OCSP response) are working fine now.

[agl1, 2013-07-29 19:32:18]

Hello golang-dev@googlegroups.com, dayveday@gmail.com, paul@vanbrouwershaven.com
(cc: golang-dev@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go.crypto/

[agl1, 2013-07-29 19:32:26]

*** Submitted as
https://code.google.com/p/go/source/detail?r=9c36e9eca3b5&repo=crypto ***

go.crypto/ocsp: pass in the issuing certificate.

Paul van Brouwershaven pointed out that it would be better to pass in
the issuing certificate and have the verification be done in the OCSP
package than to expect the caller to deal with the difference between
responses with and without a responder certificate.

R=golang-dev, dayveday, paul
CC=golang-dev
https://codereview.appspot.com/11220043