Subject: Re: Can't find info on certificate validity dates

From: "Kazin, Joel" <[email-masked]>
Date: Fri, 12 Aug 2005 07:59:26 -0500

My recollection is that RFC 3280 is silent on the issue.  The Microsoft 2003
CA will not sign certificates that have a notAfter date that is greater than
its own signing certificate.

At 06:58 PM 8/11/2005 -0500, Aram Perez wrote:

Hi Folks, 

Is there an RFC that talks about the validity dates on CA  
certificates and the validity dates for the certificates it (the CA)  
issues? For example, if a "conformant" CA certificate has a notAfter  
date of Dec. 31, 2005, should it issue certificates that have a  
notAfter date of Jul 31, 2008? I search RFCs 3280 and 3647 and  
couldn't find anything related to my question. The cert path  
validation algorithm of 3280 only mentions that the current time be  
within the validity dates of the cert being processed. 

Thanks, 
Aram Perez 

Joel S. Kazin CPA, CISA, CISSP, CISM
Senior Consultant
Atos Origin
40 Old Sleepy Hollow Road
Pleasantville, New York 10570-3802
USA
Phone  +1 914-769-8780
Mobile  +1 914-564-1484
email    [email-masked]
www.atosorigin.com <http://www.atosorigin.com/>

---

From: Arshad Noor <[email-masked]>
Date: Fri, 12 Aug 2005 10:34:18 -0700

On the other hand, I am familiar with another product that provides the
flexibility to issue certificates past its own expiration date.

It is a useful operational practice in a situation where the "Root CA"
certificate of a private company is issued by a public CA and is of a
short duration (1 year), and the PKI operations team would prefer not
to reissue their internal subordinate CA certificates every year, but
just renew the "Root CA" certificate every year and publish it at their
well-known locations so cert-chain validation can continue as usual.
This does help in optimizing some operational procedures when the
key-pair for the "Root CA" does not change.

Arshad Noor
StrongAuth, Inc.

Kazin, Joel wrote:
> My recollection is that RFC 3280 is silent on the issue.  The Microsoft 
> 2003 CA will not sign certificates that have a notAfter date that is 
> greater than its own signing certificate.
>

---

From: Julien Pierre <[email-masked]>
Date: Mon, 15 Aug 2005 18:45:20 -0700

Kazin, Joel wrote:

> My recollection is that RFC 3280 is silent on the issue.  The 
> Microsoft 2003 CA will not sign certificates that have a notAfter date 
> that is greater than its own signing certificate.

If there is no override for this, that sounds like an unfortunate 
restriction. The CA can always choose to renew its own certificate at a 
later date, which would then allow the EE cert to be validated until its 
expiration date. Perhaps it was done this way because the clients don't 
have an automatic way to update the renewed CA cert when/if it is made 
available .