<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
On 11/01/2012 03:20 PM, From Rob Stradling:
<blockquote cite="mid:5092772B.8000300@comodo.com" type="cite">Eddy,
this thread is about a straw-poll over on the PKIX list. In that
context, it is the BRs which are not relevant and RFC2560 which is
relevant!
<br>
</blockquote>
<br>
I realized that and suspension is defined. In practice, are there
any CAs that have a policy defined for suspensions?<br>
<br>
<blockquote cite="mid:5092772B.8000300@comodo.com" type="cite">
I presume you're talking about this clause from the BRs v1.1:
<br>
"13.2.4 Deletion of Entries
<br>
Revocation entries on a CRL or OCSP Response MUST NOT be removed
until after the Expiry Date of the revoked Certificate."
<br>
<br>
That sentence, if read literally, is completely pointless. If I
remove or add or modify a CRL or OCSP Response in any way, I
invalidate its signature and so clients will barf. So even
sillier is the fact that this sentence gives me permission to
invalidate signatures on old CRLs and OCSP Responses after a
certificate has expired!
<br>
</blockquote>
<br>
Obviously nobody meant you modify an issued CRL, but the entries in
the list MUST NOT be removed until the cert expires. Very clear in
my opinion.<br>
<br>
<blockquote cite="mid:5092772B.8000300@comodo.com" type="cite">
It's not listed in the Definitions. I can imagine that some
people might interpret "Revocation entries" to be referring only
to those certificates that are intended to be permanently revoked,
and not to certificates that are only intended to be "on hold" /
"suspended".
<br>
</blockquote>
<br>
A revocation entry MUST NOT be removed, hence there is no such a
thing "on hold" or "suspended"<br>
<br>
<blockquote cite="mid:5092772B.8000300@comodo.com" type="cite">
So I agree that 13.2.4 would benefit from some clarification.
<br>
</blockquote>
<br>
Be my guest :-)<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, COO/CTO</td>
</tr>
<tr>
<td> </td>
<td><a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>XMPP: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Twitter: </td>
<td><a href="http://twitter.com/eddy_nigg">Follow Me</a></td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>