Subject: RE: WG Last Call Comment for 3280bis

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 6 Dec 2006 16:19:17 -0800

Steve,

How about the following:

Compliant producers (i.e., CAs and CRL Issuers) shall not use hold
instruction.

Compliant consumer (i.e., relying parties) shall reject the certificate
regardless of the hold instruction.  Compliant consumers may take
additional actions as suggested by the hold instruction as long as those
actions are consistent with the rejection of the certificate.

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Wednesday, December 06, 2006 6:34 PM
To: Santosh Chokhani
Cc: pkix
Subject: RE: WG Last Call Comment for 3280bis

At 2:19 PM -0800 12/6/06, Santosh Chokhani wrote:
>Steve,
>
>My apologies for the interruption.
>
>We generally use hold and suspension as the same.
>
>A practical and simple solution for 3280 Bis is to recommend that
>regardless of the hold instruction, the certificate that is on hold as
>of the time of interest shall be rejected.
>

Yes, that is the simplest thing to do. The only other question is 
what we say about hold instructions, short of banning them, given 
that we require only that a client treat a cert on hold just like any 
other cert on a CRL.

Steve

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 8 Dec 2006 11:25:11 +0000

To be picky;
We need to be careful not to say that anyone must reject a certificate. This is still a decision of the RP. There is a difference between the decision to rely on something for a business reason and to accept the certificate as valid.

What we should say is that: A certificate on hold MUST be treated as revoked and MUST fail path validation regardless of any present hold instruction code.

What we also might want to say is: A certificate that has been cleared from on hold status to a non revoked status SHOULD be treated as if it has never been revoked or on hold. I.e. that the certificate once cleared is valid for its full validity period.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of Santosh Chokhani
> Sent: den 7 december 2006 01:19
> To: Stephen Kent
> Cc: pkix