Subject: Re: Good certificate renewal practice

From: [email-masked] (Peter Gutmann)
Date: Wed, 5 Nov 2003 03:27:38 +1300

=?iso-8859-1?Q?Fr=E9d=E9ric_Giudicelli?= <[email-masked]> writes:

>So I guess that all the earlier-suggested renewal methods are okay.

Yup, if your policy allows it.  For example the answer to the question:

  should we revoke the previous certificate and after which delay?

in my code would be that the cert will get revoked once its replacement is
created since to have two otherwise identical certs existing at the same time
will violate the CA database integrity constraints (the CA transaction
engine's ACID properties won't allow this to happen).  Note that the private
key isn't affected (you can still use it, for example, to decrypt data long
after the cert has expired), only the publicly visible CA statement about the
public portion of the key.

However, that's just one particular interpretation.  Everyone else is free to
apply whatever interpretation they choose.

>In any event is there any PKIX draft, that explicit those renewal policies?
>I'm having a hard time believing that the WG let some much room for personal
>appreciation :)

It was a in-joke, a reference to the fact that anything that no-one can really
agree on is made a policy matter, which means that someone else has to take
care of it.

Peter.