<div dir="ltr"><div>Assuming (perhaps incorrectly) that you may be using this cert for EV and BR certs:</div><div><br></div>Section 9.4 of the Baseline Requirements v1.1.6 does not describe a mandatory validity period for subordinate CA certificates. Neither does Section 2 of Appendix B.<div>
<br></div><div>Provided the certificate matches the requirements enumerated in Appendixes A and B (which are normative) and all those of Section 9 ("Certificate Content and Profile"), it should be fine.</div><div>
<br></div><div>For EV, Section 9 / Section 9.4 of EV Guidelines 1.4.3 equally do not specify a mandatory validity period for subordinate CA certificates.</div><div><br></div><div><br></div><div>Because of this, the guidance of Section 4.2.2.2.1 of RFC 2560 / RFC 6960 should apply.</div>
<div><br></div><div>As noted in those documents, "CAs may choose to issue this type of certificate with a very short lifetime and renew it frequently." </div><div><br></div><div>Note that Root Programs may have separate requirements, and you should consult the Root Program managers for further feedback. A few CC'd. At this time, I'm not aware of any Root Programs having mandatory requirements on delegated OCSP signers. Perhaps that should be something for a future Baseline Requirements update.</div>
<div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 17, 2013 at 10:51 PM, Chema López González <span dir="ltr"><<a href="mailto:clopez@firmaprofesional.com" target="_blank">clopez@firmaprofesional.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Patrick, unfortunately, I didn't get an answer at all, but I'm confident I'll get it sooner or later!</div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 17, 2013 at 7:17 PM, Patrick Tronnier <span dir="ltr"><<a href="mailto:Patrick.Tronnier@oati.net" target="_blank">Patrick.Tronnier@oati.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Chema,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Did you get a response to your question on the validity period of the OCSP signing certificate?<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">With kind regards,<u></u><u></u></span></p><p class="MsoNormal" style="text-autospace:none">
<span style="font-family:"Calibri","sans-serif""><u></u> <u></u></span></p><p class="MsoNormal" style="text-align:justify;line-height:12.05pt;text-autospace:none"><span style="font-family:"Trebuchet MS","sans-serif";color:#1f497d">Patrick Tronnier</span><span style="font-size:11.5pt;font-family:"Trebuchet MS","sans-serif""><u></u><u></u></span></p>
<p class="MsoNormal" style="text-align:justify;line-height:12.05pt;text-autospace:none"><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif"">Principal Security Architect &<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif"">Sr. Director of Quality Assurance</span><span style="font-size:11.0pt;font-family:"Trebuchet MS","sans-serif""><u></u><u></u></span></p>
<p class="MsoNormal" style="text-align:justify;line-height:12.05pt;text-autospace:none"><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif"">Phone: <a href="tel:763.201.2000" value="+17632012000" target="_blank">763.201.2000</a> <u></u><u></u></span></p>
<p class="MsoNormal" style="text-align:justify;line-height:12.05pt;text-autospace:none"><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif"">Fax: <a href="tel:763.201.5333" value="+17632015333" target="_blank">763.201.5333</a> <u></u><u></u></span></p>
<p class="MsoNormal" style="text-align:justify;line-height:12.05pt;text-autospace:none"><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif"">Direct Line: <a href="tel:763.201.2052" value="+17632012052" target="_blank">763.201.2052</a><u></u><u></u></span></p>
<p class="MsoNormal" style="text-align:justify;line-height:12.05pt;text-autospace:none"><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif"">Open Access Technology International, Inc. <u></u><u></u></span></p>
<p class="MsoNormal" style="text-align:justify;line-height:12.05pt;text-autospace:none"><span style="font-size:10.0pt;font-family:"Trebuchet MS","sans-serif"">3660 Technology Drive NE, Minneapolis, MN 55418 <u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Trebuchet MS","sans-serif""><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">CONFIDENTIAL INFORMATION: This email and any attachment(s) contain confidential and/or proprietary information of Open Access Technology International, Inc. Do not copy or distribute without the prior written consent of OATI. If you are not a named recipient to the message, please notify the sender immediately and do not retain the message in any form, printed or electronic.</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Chema López González<br>
<b>Sent:</b> Wednesday, September 04, 2013 4:08 AM<br><b>To:</b> <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br><b>Subject:</b> [cabfpub] OCSP Response Signing Certificate Validity Period with No-Check extension<u></u><u></u></span></p>
<div><div class="h5">
<div><div><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal">Dear all,<u></u><u></u></p><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">We, Firmaprofesional, are in the process of enable EV Certificate check in Mozilla (among others) and an issue has raised.<u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Our OCSP Response Signing Certificate does not have enable the No-Check extension, so we need to issue a new OCSP Response Signing Certificate. Is there any (mandatory) limitation on the validity period of these certificates, since there is no possibility to revoke then (al least, to ask for its status)?<u></u><u></u></p>
</div><div><p class="MsoNormal"><u></u> <u></u></p></div><div><p class="MsoNormal">Thanks in advance,<u></u><u></u></p></div><div><p class="MsoNormal"><br clear="all"><u></u><u></u></p><div><p class="MsoNormal"><u></u> <u></u></p>
</div><p class="MsoNormal">-- <u></u><u></u></p><div><table border="0" cellpadding="0"><tbody><tr><td style="padding:.75pt .75pt .75pt .75pt"><p class="MsoNormal"><a href="http://www.firmaprofesional.com/" target="_blank"><span style="color:#1155cc;text-decoration:none"><img border="0" alt="AC Firmaprofesional S.A."></span></a><u></u><u></u></p>
</td><td style="padding:.75pt .75pt .75pt .75pt"><p><b><span style="font-family:"Arial","sans-serif";color:#999999">Chema López González<br> <br>AC Firmaprofesional S.A.</span></b><span style="color:#999999"><u></u><u></u></span></p>
</td></tr><tr><td style="padding:.75pt .75pt .75pt .75pt"></td><td style="padding:.75pt .75pt .75pt .75pt"><p class="MsoNormal"><br><span style="font-family:"Arial","sans-serif";color:#999999">Av. Torre Blanca, 57.</span> <br>
<span style="font-family:"Arial","sans-serif";color:#999999">Edificio ESADECREAPOLIS - 1B13</span><u></u><u></u></p><div><p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#999999">08173 Sant Cugat del Vallès. Barcelona.<u></u><u></u></span></p>
</div><div><p class="MsoNormal"><span style="color:#999999">Tel: </span>93.477.42.45<span style="color:#999999"> /</span><span style="color:#3333ff"> 666.429.224</span><u></u><u></u></p></div></td></tr></tbody></table><p class="MsoNormal">
<u></u> <u></u></p><div><p class="MsoNormal">El contenido de este mensaje y de sus anexos es confidencial. Si no es el destinatario, le hacemos saber que está prohibido utilizarlo, divulgarlo y/o copiarlo sin tener la autorización correspondiente. Si ha recibido este mensaje por error, le agradeceríamos que lo haga saber inmediatamente al remitente y que proceda a destruir el mensaje.<u></u><u></u></p>
</div></div></div></div></div></div></div></div></div></div></blockquote></div><div><div class="h5"><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><table><tbody><tr><td><a href="http://www.firmaprofesional.com/" style="color:rgb(17,85,204)" target="_blank"><img alt="AC Firmaprofesional S.A." border="0"></a><br>
</td><td style="color:rgb(153,153,153)"><p><font face="Arial"><b>Chema López González<br> <br>AC Firmaprofesional S.A.<br></b></font></p></td></tr><tr><td><br></td><td><br><span style="color:rgb(153,153,153);font-family:Arial;font-size:small">Av. Torre Blanca, 57.</span> <br>
<font color="#999999" style="color:rgb(153,153,153)"><span style="font-family:Arial;font-size:small">Edificio ESADECREAPOLIS - 1B13</span><br></font><blockquote style="padding:0px;border-style:none;margin:0px 0px 0px 40px">
</blockquote><font><span style="color:rgb(153,153,153);font-family:Arial;font-size:small"><div style="text-align:-webkit-auto">08173 Sant Cugat del Vallès. Barcelona.</div></span><div style="text-align:-webkit-auto"><font><font color="#999999">Tel: </font><a value="+34934774245" style="color:rgb(17,85,204)">93.477.42.45</a><font color="#999999"> /</font><font color="#3333ff"> <a>666.429.224</a></font></font></div>
</font></td></tr></tbody></table><br><div>El contenido de este mensaje y de sus anexos es confidencial. Si no es el destinatario, le hacemos saber que está prohibido utilizarlo, divulgarlo y/o copiarlo sin tener la autorización correspondiente. Si ha recibido este mensaje por error, le agradeceríamos que lo haga saber inmediatamente al remitente y que proceda a destruir el mensaje.</div>
</div>
</div></div></div>
<br>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
<br></blockquote></div><br></div>