Subject: RE: Certificate Hold (was RE: delta CRLs)

From: "Housley, Russ" <[email-masked]>
Date: Tue, 08 May 2001 08:42:04 -0400

Ambarish:

Thanks.  Many OCSP responders get their revocation information bay way of a 
CRL, so this would seem to be a good reason to not prohibit the use of the 
feature.

Russ

At 09:54 PM 5/7/2001 -0700, Ambarish Malpani wrote:
>
>Russ, while I don't object to us deprecating the use of certificate
>suspension, I don't think we should prohibit its usage.
>
>Certificate suspension is a useful mechanism to prevent the usage of
>a certificate while you figure out whether it should actually be
>revoked or not.
>
>I don't agree with us saying that PKIX supports suspension only via
>OCSP - that just sounds wrong to me.
>
>Regards,
>Ambarish
>
>-----Original Message-----
>From: Housley, Russ
>To: Tom Gindin
>Cc: [email-masked]
>Sent: 5/7/01 10:13 AM
>Subject: RE: Certificate Hold (was RE: delta CRLs)
>
>Tom:
>
>I have not been able to make myself clear.  Perhaps because you keep
>looking to simple authentication applications.  My hope is that the PKIX
>
>profile will readily meet the needs of these relatively straightforward
>applications and also support the more demanding needs of applications
>where non-repudiation is needed.
>
>All:
>
>My view of the question is that three people have voiced a desire to see
>
>the suspension feature removed, one is asking questions without voicing
>a
>position, and no one has asked to keep it.  People who have an opinion
>but
>have not posted it yet please do so.
>
>Russ

---

From: Rich Salz <[email-masked]>
Date: Tue, 08 May 2001 09:49:31 -0400

> Many OCSP responders get their revocation information bay way of a

The problem I've always had with hold is that it introduces state across
CRL's.  Still and all, I agree deprecation is the way to go.
	/r$