Subject: Re: Good certificate renewal practice

From: [email-masked] (Peter Gutmann)
Date: Mon, 3 Nov 2003 19:14:41 +1300

=?iso-8859-1?Q?Fr=E9d=E9ric_Giudicelli?= <[email-masked]> writes:

>After reviewing "pkix-roadmap" and "rfc2510bis" I found no details on how
>PKIs should handle certificates renewal.

That's a policy matter.

>Can a user request a renewal even if his/her certificate is not about to
>expiry?

That's a policy matter.

>If yes, should we revoke the previous certificate and after which delay?

That's a policy matter.

>Can a user request a renewal even if his/her certificate has expired?

Th.... well, you get the idea.

Peter.

(Incidentally, the person who originally suggested the ecumenical/policy
 comment has since expressed regret that he didn't trademark it or something
 :-).

---

From: Frédéric Giudicelli <[email-masked]>
Date: Mon, 3 Nov 2003 07:29:45 +0100

So I guess that all the earlier-suggested renewal methods are okay.
In any event is there any PKIX draft, that explicit those renewal policies?
I'm having a hard time believing that the WG let some much room for personal
appreciation :)

Frédéric Giudicelli
http://www.newpki.org

(Are you trying to say that you would be rich by now?)