[cabfpub] Fwd: [pkix] Straw-poll on OCSP responses for non-revoked certificates.

[Erwann Abalea]

Resumption is necessary in deltaCRLs, and is only allowed in deltaCRLs.
Suspension is allowed in every type of CRLs.
We produce deltaCRLs for some CAs but no public one.

-- 
Erwann ABALEA

Le 07/11/2012 19:25, Rick Andrews a écrit :
>
> When I looked at the RFC some time ago, it seemed that suspension and 
> resumption were only allowed in delta CRLs. I don't know of any CAs or 
> browsers that support delta CRLs.
>
> -Rick
>
> *From:*public-bounces at cabforum.org 
> [mailto:public-bounces at cabforum.org] *On Behalf Of *i-barreira at izenpe.net
> *Sent:* Wednesday, November 07, 2012 12:52 AM
> *To:* eddy_nigg at startcom.org; public at cabforum.org
> *Subject:* Re: [cabfpub] Fwd: [pkix] Straw-poll on OCSP responses for 
> non-revoked certificates.
>
> On the CRL you can suspend a certificate (the response is revoked) and 
> turned it back to a good status and this is perfectly valid.
>
> **
>
> *Iñigo Barreira*
> Responsable del Área técnica
> i-barreira at izenpe.net <mailto:i-barreira at izenpe.net>
>
> 945067705
>
> ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta 
> egotea. Mezua badu bere hartzailea. Okerreko helbidera heldu bada 
> (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, 
> korreo honi erantzuna. KONTUZ!
> ATENCION! Este mensaje contiene informacion privilegiada o 
> confidencial a la que solo tiene derecho a acceder el destinatario. Si 
> usted lo recibe por error le agradeceriamos que no hiciera uso de la 
> informacion y que se pusiese en contacto con el remitente.
>
> *De:*public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] 
> *En nombre de *Eddy Nigg (StartCom Ltd.)
> *Enviado el:* miércoles, 31 de octubre de 2012 21:45
> *Para:* public at cabforum.org
> *Asunto:* Re: [cabfpub] Fwd: [pkix] Straw-poll on OCSP responses for 
> non-revoked certificates.
>
>
> On 10/31/2012 10:32 PM, From Ben Wilson:
>
> If a modification of RFC 2560 allows an extension to change the 
> meaning of a "1" response to something else.  It was you who said 
> "[it] might be good, ..., either due to migration and update time or 
> other reasons (out-of-sync cor whatever)."
>
>
> Yes, that's why I think using "Unknown" is the correct response and 
> not revoked for those. A revoked certificate can't be made valid ever 
> after as long as it hasn't expired. And "Unknown" != "Good".
>
> However once a certificate was marked as revoked, in my opinion a 
> client doesn't have to check again ever.
>
> Regards
>
> Signer:
>
> 	
>
> Eddy Nigg, COO/CTO
>
> 	
>
> StartCom Ltd. <http://www.startcom.org>
>
> XMPP:
>
> 	
>
> startcom at startcom.org <xmpp:startcom at startcom.org>
>
> Blog:
>
> 	
>
> Join the Revolution! <http://blog.startcom.org>
>
> Twitter:
>
> 	
>
> Follow Me <http://twitter.com/eddy_nigg>
>
>
>
> _______________________________________________
> Public mailing list
> Public at cabforum.org
> https://cabforum.org/mailman/listinfo/public

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20121107/7b66fcd3/attachment-0004.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 19121 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20121107/7b66fcd3/attachment-0004.png>