<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 03/06/2020 13:31, David Kluge wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAO5jakC212BAKb9SpOJ2jjjG3+jdgmiG3+S4BqPhs=wQdtHcXg@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">I agree that retaining certificate profiles can be
useful and the data volume involved is rather small.
<div>We could just add a separate paragraph to section 5.4.1 and
define what profile related information to retain and for how
long?
<div><font face="-apple-system, system-ui, Segoe UI,
Helvetica, Arial, sans-serif, Apple Color Emoji, Segoe UI
Emoji" color="#24292e"><span style="font-size:16.25px"></span></font></div>
</div>
</div>
<br>
</blockquote>
<p>Since Certificate Profiles are _usually_ tied to a particular CA,
I would say that creation, modification and deletion of
certificate profiles could be added to 5.4.1 (1); that would imply
a responsibility to hold onto all profiles attached to an Issuing
CA for the life of the CA Private Key/Certificates plus 2 years.</p>
<p>Something like</p>
<p>"x. Creation, modification and deletion of certificate profiles
which define certificates which are signed by the CA Private Key"</p>
<p>"y. Creation, modification and deletion of CRL profiles which
define CRLs which are signed by the CA Private Key"</p>
<p>It's probably the sort of thing which lives in a source code
control system ; and it's a pretty small data set, IMO. So it's
not like we're asking for indexing and reporting of totally
unstructured data.<br>
</p>
<p>Does this make sense? I wouldn't want to add anything to the CA
Key/Certificate Lifecycle section except things which are
intimately tied to the CA Key/Certificate itself.<br>
</p>
<p>Couple of downsides:</p>
<p>What is a "certificate profile"? It's not a defined term. We have
an intuitive notion of what it means, but is that good enough?
Probably - since we also say things like "security profiles".</p>
<p>It is possible for a certificate profile to be shared across
issuing CAs; what would be the retention of that? I guess that we
could just constrain it to be the pair (CA Key, Certificate
Profile), so that if it were shared, it would be the longest lived
of the CA Private Keys.</p>
<p>Any better constructions?</p>
<p>Neil<br>
</p>
</body>
</html>