Subject: Re: End entity validity date nesting

From: Joel Kazin <[email-masked]>
Date: Tue, 18 Jul 2006 17:43:42 -0400

Ogle Ron wrote:

>Where does it state that a CA is required to only issue certificates
>whose entire lifetime falls within the CA's lifetime?  I have googled
>this, and I see where many people believe that this should be the case.
>However, I have not found the requirement in X.509 nor PKIX RFCs.
>  
>
I don't recall it being explicitly stated in RFC 3280. However, an 
expired CA certificate cannot under RFC 3280 be used to establish a 
chain of trust. 

>BTW, it does make logical sense to me to do this.  For example, how does
>a CA sign a CRL after the CA's certificate has expired without rolling
>over the CA?
>  
>
It can sign the CRL, but you should not trust the CA.

By the way, both Microsoft and Entrust do it the right way.

>Thanks in advance
>Ron Ogle

---

From: Stephen Kent <[email-masked]>
Date: Tue, 18 Jul 2006 17:48:46 -0400

>a CA sign a CRL after the CA's certificate has expired without rolling

Validity interval nesting is not a strict requirement. It is common 
practice, and for good reasons, but not for the one you cite.  Once 
the CA cert expires, all certs issued by it cannot be validated, 
unless a new CA cert appears, with the same key as the old cert.

Steve

---

From: "Ogle Ron" <[email-masked]>
Date: Tue, 18 Jul 2006 17:17:35 -0400

Thanks in advance
Ron Ogle

---

From: "Price, Bill" <[email-masked]>
Date: Wed, 19 Jul 2006 10:50:43 -0400

I am familiar with a CA that is used to permit interoperability
between organizational PKIs. The individual organizational PKIs may
nest validity periods. However, the validity periods are not
necessarily nested for certificate paths from an entity in one
organization through the CA that connects the organizational PKIs to
CAs in the other organization.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Stephen Kent
Sent: Tuesday, July 18, 2006 5:49 PM
To: Ogle Ron
Cc: [email-masked]
Subject: Re: End entity validity date nesting

Steve