Subject: WG: Can't find info on certificate validity dates

From: [email-masked]
Date: Tue, 16 Aug 2005 09:28:59 +0200

-----Ursprüngliche Nachricht-----
Von: Beckmann, Thomas 
Gesendet: Freitag, 12. August 2005 10:17
An: 'Aram Perez'
Betreff: AW: Can't find info on certificate validity dates

Aram,

it's a matter of policy. In gerneral a CA is not prohibited to issue
certificates with a notAfter entry later than the notAfter entry in the CA
certificate.
In the context of the german signature act this is done almost ervery time
because the root is only valid one year and enduser certificates can be
valid up to five years. The idea behind is to have a validation mechanism
different from them PEM and PKIX one. A signature is not checked valid a the
actual time at the time of signature creation. I. e. a certificate should
have been valid at the time of signature creation and can be invalid now but
the signature is still valid.

I hope this helps

Regards

Thomas Beckmann

> -----Ursprüngliche Nachricht-----
> Von: [email-masked]
> [mailto:[email-masked]]Im Auftrag von Aram Perez
> Gesendet: Freitag, 12. August 2005 01:59
> An: [email-masked]
> Betreff: Can't find info on certificate validity dates
> 
> 
> 
> Hi Folks,
> 
> Is there an RFC that talks about the validity dates on CA  
> certificates and the validity dates for the certificates it (the CA)  
> issues? For example, if a "conformant" CA certificate has a notAfter  
> date of Dec. 31, 2005, should it issue certificates that have a  
> notAfter date of Jul 31, 2008? I search RFCs 3280 and 3647 and  
> couldn't find anything related to my question. The cert path  
> validation algorithm of 3280 only mentions that the current time be  
> within the validity dates of the cert being processed.
> 
> Thanks,
> Aram Perez
> 
>