[cabfpub] Issuance of certificates for keys reported as compromised

[Tim Hollebeek]

Should we update the BRs to disallow issuance of certificates for key pairs
that have been previously reported as compromised?

 

I'm not aware of any CAs that currently do that check today, but it's not
that difficult to do.  It might be a sensible thing to add in the future.
However it only works if all CAs do it, otherwise subscribers will just get
their compromised key signed by a different CA.

 

-Tim

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20180821/e36813c1/attachment-0002.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4940 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20180821/e36813c1/attachment-0002.p7s>