Subject: Putting a certificate on hold with CMP (and removing it)

From: Teemu Alakoski <[email-masked]>
Date: Wed, 26 Apr 2006 10:09:14 +0300

Hi,

To my understanding, CMP can be used to put a certificate on hold using crlEntryDetails field of the RevReqContent structure. This is achieved by using a crlEntryDetails that contains a certificateHold CRLReason. Is it, however, possible to remove the hold status from a certificate with CMP?

Apparently removeFromCRL CRLReason can't be used for this purpose because it is, according to ISO/IEC 9594-8:2001, for use with delta-CRLs only. To me it seems that using this reason code in RevReqContent to remove certificate's hold status is not what the designers of the CMP meant.

Teemu

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 27 Apr 2006 04:17:10 +1200

Teemu Alakoski <[email-masked]> writes:

>To my understanding, CMP can be used to put a certificate on hold using
>crlEntryDetails field of the RevReqContent structure. This is achieved by
>using a crlEntryDetails that contains a certificateHold CRLReason. Is it,
>however, possible to remove the hold status from a certificate with CMP?

It's not even certain how to do this *without* CMP, there are a pile of
different (mostly incompatible) opinions on how certificate holds are actually
supposed to work in practice.  Once you add CMP to the mix, all bets are off.
If your implementation supports handling of this, the quick answer is to do
whatever the implementation requires.

(Insert additional paragraphs that contain the word "policy" in every other
 sentence).

Peter.