Subject: Good certificate renewal practice

From: Frédéric Giudicelli <[email-masked]>
Date: Mon, 3 Nov 2003 05:51:22 +0100

Hello,
After reviewing "pkix-roadmap" and "rfc2510bis" I found no details on how
PKIs should handle certificates renewal.
Can a user request a renewal even if his/her certificate is not about to
expiry? If yes, should we revoke the previous certificate and after which
delay?
Can a user request a renewal even if his/her certificate has expired?
I'm just lost on how implementing certificate renewal in my PKI.

Thanks,
Frédéric Giudicelli
http://www.newpki.org

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 3 Nov 2003 08:44:35 +0100

I believe this is outside of standards.
But I am sure it should conceptually work as it does for credit-cards,
passports etc.   I.e. you receive (automatically or on your own
responsibility) a new card etc. before the existing has expired.
There are no technical needs for revoking as far as I can see.
In an on-line PKI I would assume that the old certificate would
be replaced by the new one automatically.  But on-line certification
is not standardized, and everyone makes their own "pudding"
and assign their own policy.

From a recent message of mine:

=============================================
   Practically every piece of client-side Web-PKI, ranging
   from on-line certification support to on-line (web-form)
   signing, is currently entirely vendor-dependent
=============================================

I will check out newpki.org!

Anders

----- Original Message -----
From: "Frédéric Giudicelli" <[email-masked]>
To: <[email-masked]>
Sent: Monday, November 03, 2003 05:51
Subject: Good certificate renewal practice

Hello,

Thanks,
Frédéric Giudicelli
http://www.newpki.org