<div dir="ltr">Oh wait, I did have one additional thought:<div><br></div><div>I'm not in favor of allowing CRLs to remain non-updated for 7 days because that is a regression from current OCSP behavior. Section 4.9.10.(4) makes it so that updated revocation information is always available "no later than four days after the thisUpdate". Therefore, a CA operating in a CRLs-only mode should be required to update their CRLs at least once every 4 days.</div><div><br></div><div>Thanks, and apologies for double-posting,</div><div>Aaron</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 3, 2023 at 1:26 PM Aaron Gable via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">Apologies for how long this has run on, and thank you for the great discussion as well!<div><br></div></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 3, 2023 at 1:49 AM Dimitris Zacharopoulos (HARICA) <<a href="mailto:dzacharo@harica.gr" target="_blank">dzacharo@harica.gr</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div><br>
I explained when the clock starts. A CA would have evidence to show
when it marked a certain certificate as revoked, and when the CRL
containing that entry was issued.<br></div></blockquote><div><br></div><div>I guess this is largely a question of semantics, then. I agree that it should generally be possible for a CA to know when it "decided" to revoke a certificate, when it "marked" that certificate as revoked in an internal database, or took some similar action. But I think there's plenty of precedent on this list and in Bugzilla tickets that doing so does not count as "revoking" the certificate -- that doesn't happen until signed statements of revocation (OCSP or CRL) are widely published.</div><div><br></div><div>So if we want to have a requirement like you propose, I would ask that it use some phrasing other than . Perhaps something like "The CA MUST update and reissue CRLs at least 1) once every 7 days; or 2) within 24 hours after conclusively determining that a certificate within that CRL's scope must be revoked." I don't love that phrasing, as it introduces a new term of art "conclusively determining" similar to the existing and hotly-debated "becomes aware", but I like it better than "with 24 hours after revoking".</div><div><br></div><div>And yes, I take issue with the way the requirement for Subordinate CA Certificates is phrased today :) I'd like to change both!</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
This cannot apply in all cases described in 4.9.1.1. It would
probably make sense to apply in cases where the Subscriber requests
the revocation after proper authentication, in which case the CA
probably doesn't need to do any investigation.<br></div></blockquote><div><br></div><div>Heh, we're in agreement here; that's exactly what I meant by "Paragraph 1", i.e. the enumerated point beginning "1. The Subscriber requests in writing...". I guess "4.9.1.1(1)" is what I should have said.</div><div> </div><div>I think that Ryan Dickson's proposed set of ballot updates (<a href="https://github.com/ryancdickson/staging/pull/3" target="_blank">https://github.com/ryancdickson/staging/pull/3</a>, from the other thread discussing this ballot) go a long way towards addressing concerns brought up by both of us. I've left specific comments on that PR, as a way to laser-focus this discussion onto specifics of phrasing.</div><div><br></div><div>Aaron</div></div></div>
_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div>