Subject: RE: Best rollover practise

From: "Trevor Freeman" <[email-masked]>
Date: Mon, 20 Jan 2003 11:32:29 -0800

It always amazes me to see views on basic issues like root rollover
where there is still little consensus.

Q1. Theoretically you can issue either a 25 or a 50 day certificate.
There is certainly no commercial product consensus on whether you roll
your root first then issue the 50 day certificate or issue the
certificate and then roll your root.

Q2. Theoretically yes, but again it's up to the product.

Q3. Depends on if you roll your root key as well as your certificate. IN
both cases you have from the time you roll your root till the old root
expires to distribute the new root. 

Trevor

-----Original Message-----
From: Joel S. Kazin [mailto:[email-masked]] 
Sent: Monday, January 20, 2003 7:23 AM
To: Haaino Beljaars; [email-masked]
Subject: Re: Best rollover practise

At 08:31 PM 1/19/2003 +0100, Haaino Beljaars wrote:

>Hi,
>
>Hope somebody can tell me more about 'rollover' practises.
>
>I have the following example: I have a Root CA which has a validity
time of
>100 days, which issues directly to end-users. The end-users get an
end-user
>certificate which has a validity time of 50 days (this is no be change
the
>half of the Root CA validity time). During the life time of the Root CA
an
>end-user can receive a maximum of two end-user certificates.
>
>My questions are:
>* if I issue an end-user certificate on the 25th day of the life time
of the
>Root CA, and the end-user comes back for an update of his certificate
(on
>day 75), should I issue an end-user certificate of 50 days or 25 days?

25 days.

>* May I issue certificates which have a longer life time then the
issuing CA
>if I know that at the end of the life time of the CA I'll perform an
>rollover on the CA?

No.

>* An other scenario could be that I already rollover the issuing CA on
day
>50 of the Root CA lifetime, and start issuing end-user certificates
from
>that CA instead. But then I have 2 CA which seem to the outside world
as the
>same.

You will have two CA certificates. Commercial products, i.e., Entrust,
have 
the old CA certificate signed by the private key associated with the new
CA 
Certificate.

>Any suggestions?
>Best regards,
>Haaino

Senior Consultant
Technical Consulting Practice, Northeast Region
Schlumberger Network Solutions

[email-masked]
www.slb.com/nws

35 Waterview Blvd.
Suite 210
Parsippany, NJ 07054-1200
USA

Phone  +1 914-769-8780
Mobile  +1 914-645-5598