Subject: RE: End entity validity date nesting

From: "Santosh Chokhani" <[email-masked]>
Date: Sun, 23 Jul 2006 14:42:15 -0700

In a cross certified environments and in Bridge CA, it is not practical
and  it is difficult to enforce (and there no reason to) nested validity
periods.  Besides there is no security reason to do it.

In order to address the point Steve Kent brought up, the
cross-certificates containing the same key can be renewed in order to
ensure that signatures chain.  Another alternative will be to re-issue
the certificates using the new key for the CA.  But, if one were to
enforce nesting of validity periods, certification path validation will
fail for no good security reason.

From: [email-masked] 
[mailto:[email-masked]]On Behalf Of Price, Bill 
Sent: Wednesday, July 19, 2006 10:51 AM 
To: Stephen Kent; Ogle Ron 
Cc: [email-masked] 
Subject: RE: End entity validity date nesting 

 I am familiar with a CA that is used to permit interoperability 
between organizational PKIs. The individual organizational PKIs may 
nest validity periods. However, the validity periods are not 
necessarily nested for certificate paths from an entity in one 
organization through the CA that connects the organizational PKIs to 
CAs in the other organization. 

-----Original Message----- 
From: [email-masked] 
[mailto:[email-masked]] On Behalf Of Stephen Kent 
Sent: Tuesday, July 18, 2006 5:49 PM 
To: Ogle Ron 
Cc: [email-masked] 
Subject: Re: End entity validity date nesting 

At 5:17 PM -0400 7/18/06, Ogle Ron wrote: 
>Where does it state that a CA is required to only issue certificates 
>whose entire lifetime falls within the CA's lifetime?  I have googled 
>this, and I see where many people believe that this should be the 
case. 
>However, I have not found the requirement in X.509 nor PKIX RFCs. 
> 
>BTW, it does make logical sense to me to do this.  For example, how 
does 
>a CA sign a CRL after the CA's certificate has expired without rolling 
>over the CA? 
> 
>Thanks in advance 
>Ron Ogle 

Validity interval nesting is not a strict requirement. It is common 
practice, and for good reasons, but not for the one you cite.  Once 
the CA cert expires, all certs issued by it cannot be validated, 
unless a new CA cert appears, with the same key as the old cert. 

Steve