[Servercert-wg] [EXTERNAL] Ballot SC23: Precertificates

Ryan Sleevi sleevi at google.com
Fri Oct 18 06:47:05 MST 2019


On Fri, Oct 18, 2019 at 6:38 AM Dimitris Zacharopoulos (HARICA) <
dzacharo at harica.gr> wrote:

> I was under the impression that the SHOULD was for Technically
> Constrained subCAs and there was a rule to change them to MUST after
> 2013-08-01. This is not the case so the commit related to the removal of
> effective date for TCSCAs is fine.


This isn't quite worded correctly.

Non-Technically Constrained subCAs MUST support this capability.
Technically Constrained subCAs SHOULD support this capability.

The wording in SC23 preserves this. We have, for better or worse, not yet
mandated technically constrained subCAs MUST NOT return "good" for
non-issued serials.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/servercert-wg/attachments/20191018/3534b736/attachment.html>


More information about the Servercert-wg mailing list