<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-15">
</head>
<body>
<p><font face="Calibri">All,</font></p>
<p><font face="Calibri">this is probably an old matter, but I could
not solve my doubts browsing the past posts.</font></p>
<p><font face="Calibri">I suppose, but I am not certain, that - as
for SSL Server certificates - Code Signing certificates must not
be suspended (that is, there must not be a CRLReason
"certificateHold" in a CRL entry). But maybe I am wrong, as I
cannot find the relevant language in the Code Signing BR.
Anybody, please point me at the right spot in the document.</font></p>
<p><font face="Calibri">TIA</font></p>
<p><font face="Calibri">Adriano</font></p>
<p><font face="Calibri"></font><br>
</p>
<div class="moz-cite-prefix">Il 01/02/2021 10:32, Dimitris
Zacharopoulos (HARICA) via Cscwg-public ha scritto:<br>
</div>
<blockquote type="cite"
cite="mid:010001775cef5538-88a675f8-4a11-4c36-ae4f-84be84ee13cd-000000@email.amazonses.com"><br>
According to the requirements, and section 13.2.1:
<br>
<br>
"CAs MUST provide OCSP responses for Code Signing Certificates and
Timestamp Certificates for the time period specified in their CPS,
which MUST be at least 10 years after the expiration of the
certificate"
<br>
<br>
However, according to Certificate Consumer policies, either CRL or
OCSP is required to be used.
<br>
<br>
I would like to ask for Members to consider requiring either CRL
or OCSP information to be required in end-entity certificates used
for Time-stamping. The rationale is that Time-stamping
Certificates are very few compared to other end-entity
certificates and CRLs should be considered sufficient because
their size is not significant.
<br>
<br>
Please let me know your thoughts, concerns or objections.
<br>
<br>
<br>
Thank you,
<br>
Dimitris.
<br>
_______________________________________________
<br>
Cscwg-public mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:Cscwg-public@cabforum.org">Cscwg-public@cabforum.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://lists.cabforum.org/mailman/listinfo/cscwg-public">https://lists.cabforum.org/mailman/listinfo/cscwg-public</a>
<br>
</blockquote>
</body>
</html>