<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 1, 2017, at 10:51 AM, Ryan Sleevi via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Wed, Feb 1, 2017 at 10:49 AM, Ryan Sleevi <span dir="ltr" class=""><<a href="mailto:sleevi@google.com" target="_blank" class="">sleevi@google.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr" class=""><div class="gmail_extra"><span style="font-size:12.8px" class="">Reposing on behalf of </span><span name="Jürgen Brauckmann" class="gmail-m_-2027377797794697035gmail-gD" style="font-size:12.8px">Jürgen Brauckmann</span><span style="font-size:12.8px;white-space:nowrap" class=""> </span><span class="gmail-m_-2027377797794697035gmail-go" style="font-size:12.8px;white-space:nowrap"><span class=""><</span><a href="mailto:brauckmann@dfn-cert.de" target="_blank" class="">brauckmann@dfn-<wbr class="">cert.de</a><span class="">></span></span></div><div class="gmail_extra"><span class="gmail-m_-2027377797794697035gmail-go" style="font-size:12.8px;white-space:nowrap"><span class=""><br class=""></span></span></div><div class="gmail_extra"><span class="gmail-"><span style="font-size:12.8px" class="">Ryan Sleevi via Public schrieb:</span><br style="font-size:12.8px" class=""></span><span class="gmail-"><span class="gmail-m_-2027377797794697035gmail-im" style="font-size:12.8px">> 4. The CA has not revoked any certificates which contain certificate<br class="">> information verified using the document or data.<br class=""><br class=""></span></span><span class="gmail-"><span style="font-size:12.8px" class="">Your goal is to kill OV?</span></span></div></div></blockquote><div class=""><br class=""></div><div class=""><div class="">And why does OV require revocation? OV totally remains valid, so long as you're not revoking those certs.</div><div class=""><br class=""></div><div class="">As mentioned in my other message just now, beyond keyCompromise, what other reasons would you revoke a cert? Surely if you revoke a cert because of "affiliationChanged", you should very well be revalidating the affiliation before issuing a new cert; otherwise, you could revoke the cert and totally reissue it using the original bogus information.</div></div></div></div></div></div></blockquote><br class=""></div><div><div class="adn ads" style="padding-bottom: 20px; border-left-width: 1px; border-left-style: solid; border-left-color: transparent; padding-left: 4px; color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: medium; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);"><div class="gs" style="margin-left: 30px;"><div id=":5v7" class="gt adO ii adP" style="font-size: 12.8px; direction: ltr; margin: 5px 15px 0px 0px; padding-bottom: 5px; position: relative;"><div id=":5xj" class="a3s aXjCH m159fb09e1dcfe9c2" style="overflow: hidden;">Consider these revocation reasons in the X.509 text:<br class=""><br class="">- superseded indicates that the certificate has been superseded but<br class="">there is no cause to suspect that the private key has been compromised<br class=""><br class="">- cessationOfOperation indicates that the certificate is no longer<br class="">needed for the purpose for which it was issued but there is no cause<br class="">to suspect that the private key has been compromise<br class=""><br class="">If a customer is replacing certificate X with certificate Y (probably<br class="">with the same SANs), it is completely reasonable for them to request<br class="">revocation of X once Y is fully deployed. I would use "superseded"<br class="">for this case. It is also possible that a customer ceases to use a<br class="">server and wants to revoke using "cessationOfOperation". Neither of<br class="">these cases says anything about the validity of the domain<br class="">registration or organization information.<br class=""><br class="">Thanks,<br class="">Peter<div class="yj6qo"></div></div></div><div class="hi" style="background: rgb(242, 242, 242); padding: 0px; margin: 0px; width: auto; border-bottom-left-radius: 1px; border-bottom-right-radius: 1px;"></div></div><div class="ajx" style="clear: both;"></div></div><div class="gA gt acV" style="font-size: 12.8px; background-color: rgb(255, 255, 255); padding: 0px; width: auto; border-bottom-left-radius: 0px; border-bottom-right-radius: 0px; border-top-style: none; border-right-width: 0px; border-bottom-width: 0px; border-left-width: 0px; margin: 0px; color: rgb(34, 34, 34); font-family: arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-position: initial initial; background-repeat: initial initial;"><div class="xu gB" style="border-top: 0px; padding: 0px;"><div class="ip iq" style="clear: both; margin: 0px 5px 0px 0px; padding: 8px 0px 0px 4px; border-top: 1px solid rgb(216, 216, 216);"></div></div></div></div></body></html>