Subject: Best rollover practise

From: "Haaino Beljaars" <[email-masked]>
Date: Sun, 19 Jan 2003 20:31:43 +0100

Hi,

Hope somebody can tell me more about 'rollover' practises.

I have the following example: I have a Root CA which has a validity time of
100 days, which issues directly to end-users. The end-users get an end-user
certificate which has a validity time of 50 days (this is no be change the
half of the Root CA validity time). During the life time of the Root CA an
end-user can receive a maximum of two end-user certificates.

My questions are:
* if I issue an end-user certificate on the 25th day of the life time of the
Root CA, and the end-user comes back for an update of his certificate (on
day 75), should I issue an end-user certificate of 50 days or 25 days?
* May I issue certificates which have a longer life time then the issuing CA
if I know that at the end of the life time of the CA I'll perform an
rollover on the CA?
* An other scenario could be that I already rollover the issuing CA on day
50 of the Root CA lifetime, and start issuing end-user certificates from
that CA instead. But then I have 2 CA which seem to the outside world as the
same.

Any suggestions?

Best regards,
Haaino

---

From: "Joel S. Kazin" <[email-masked]>
Date: Mon, 20 Jan 2003 10:23:14 -0500

>day 75), should I issue an end-user certificate of 50 days or 25 days?

25 days.

>if I know that at the end of the life time of the CA I'll perform an

No.

>that CA instead. But then I have 2 CA which seem to the outside world as the

You will have two CA certificates. Commercial products, i.e., Entrust, have 
the old CA certificate signed by the private key associated with the new CA 
Certificate.

>Haaino

Senior Consultant
Technical Consulting Practice, Northeast Region
Schlumberger Network Solutions

[email-masked]
www.slb.com/nws

35 Waterview Blvd.
Suite 210
Parsippany, NJ 07054-1200
USA

Phone  +1 914-769-8780
Mobile  +1 914-645-5598