Subject: RE: Online Certificate Revocation Protocol - revoke mistakenly-is sued cert

From: "Manger, James H" <[email-masked]>
Date: Tue, 19 Jun 2001 09:45:16 +1000

This already exists.  It is called the invalidityDate CRL entry extension.
It "indicates the date at which it is known or suspected that the private
key was compromised or that the certificate should otherwise be considered
invalid.  This date may be earlier than the revocation date in the CRL
entry".

=> List the mistakenly issued cert on the CRL with an invalidityDate that is
the same as the notBefore date in the cert.

----------
From: Liaquat Khan [mailto:[email-masked]]
Sent: Monday, 18 June 2001 21:57

...However the signature was produced before the revocation occurred.  It
would be nice for the CA to indicate in the CRL within the reason code that
the certificate was never valid.  So signatures performed even before the
revocation should not be trusted...