Subject: netscape-cert-renewal-url & beyond

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 31 Mar 2007 08:32:21 +0200

Although the "netscape-cert-renewal-url" certificate extension does
not appear to be incorporated in any PKIX RFC, it is anyway
documented in vendor specs like:
http://msdn2.microsoft.com/en-us/library/aa378149.aspx

I have two open questions regarding this particular extension:

1. Is it supported by any PKI-clients and if so which ones?

2. If it is not already supported on major scale wouldn't it be
worthwhile supporting such a facility?  My personal experience
with certificates (I have had numerous), is that they tend to silently
expire, leaving you high and dry and concluding that "passwords are
better".   When you have to "renew" from scratch you are thrown
into laborious processes which can take weeks to perform.

If you have certificate and key in a connected device
like a web-server or mobile phone, you could very well
create something like we already have with Windows update,
JRE update, Adobe update, where the user in some instances
only would have to issue a PIN in order to get a credential
update.   For commercial certificates the process would be
slightly more complex but of course an auto-renewal-process
must support this use-case as well.

I do not propose making the Netscape extension a PKIX
standard but rather start discussing the road to a better
support of credential life-cycles.

Comments?

Anders Rundgren