Subject: RE: Certificate Hold (was RE: delta CRLs)

From: Ambarish Malpani <[email-masked]>
Date: Mon, 07 May 2001 21:54:54 -0700

Russ, while I don't object to us deprecating the use of certificate
suspension, I don't think we should prohibit its usage.

Certificate suspension is a useful mechanism to prevent the usage of
a certificate while you figure out whether it should actually be
revoked or not.

I don't agree with us saying that PKIX supports suspension only via
OCSP - that just sounds wrong to me.

Regards,
Ambarish

-----Original Message-----
From: Housley, Russ
To: Tom Gindin
Cc: [email-masked]
Sent: 5/7/01 10:13 AM
Subject: RE: Certificate Hold (was RE: delta CRLs)

Tom:

I have not been able to make myself clear.  Perhaps because you keep 
looking to simple authentication applications.  My hope is that the PKIX

profile will readily meet the needs of these relatively straightforward 
applications and also support the more demanding needs of applications 
where non-repudiation is needed.

All:

My view of the question is that three people have voiced a desire to see

the suspension feature removed, one is asking questions without voicing
a 
position, and no one has asked to keep it.  People who have an opinion
but 
have not posted it yet please do so.

Russ

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 10 May 2001 11:30:48 +0200

Ambarish,
 
> suspension, I don't think we should prohibit its usage.

I would object to deprecate the use of certificate suspension using CRLs.

> OCSP - that just sounds wrong to me.

I support the two other points.

Regards,

Denis