Subject: Renewal or Re-keying services into CMC protocol

From: "Manuel Gil Perez" <[email-masked]>
Date: Fri, 28 May 2004 14:45:21 +0200

Hi everyone.

I'm implementing the CMC protocol and I've several doubts about renewal and
re-keing services. The protocol specifies that "a renewal/re-key message
looks the same as any enrollment message, with the identity proof being
supplied by existing certificates from the CA". For instance, when I like to
make a renewal request it's a few unreasonable I create a enrollment message
with data of the client certificate because for any LRA/RA this
certification request doesn't serve for nothing.

On the other hand, I can still send a Full PKI Request message with the
PKIData sequence empty, but it seems unsuitable too. Even, how I can know
the kind of message (renewal or re-keing) from the server side??

For a re-key message, the problem is the same. What should I do??

From my honest opinion, I would created a new type of message for these
services.

Thanks a lot!

  Manuel Gil.-

---
Information extracted from the RFC 2797:

 * No special services are provided for doing either renewal (new
certificates
 * with the same key) or re-keying (new certificates on new keys) of
clients.
 * Instead a renewal/re-key message looks the same as any enrollment
message,
 * with the identity proof being supplied by existing certificates from the
CA.
 *
 * In a renewal or re-key message, the subject DN in (a) the certificate
 * referenced by the CMS SignerInfo object, and (b) all certificate requests
 * within the request message MUST match according to the standard.