Subject: Re: Invalidity Dates

From: [email-masked]
Date: Mon, 14 Dec 1998 10:47:15 -0500

Thanks Steve and Dan. Is anyone willing to speak up on behalf
of not letting a user indicate an invalidity date previous to the
current CRL? Because the spec seems to be indicating that
that should be the disallowed, but I haven't heard any strong
reason for restricting the user to that. Which makes me worried
that I'm missing something.
     Mez

---

From: David Solo <[email-masked]>
Date: Mon, 14 Dec 1998 14:43:17 -0500

MEZ,

I think you may be mixing two dates.  There is a revocation date in the
standard CRL entry.  This is the date assigned by the CA as logically
having added the entry and so may not predate the last CRL.  The
invalidity date is a CRL entry extension which is supplied by the user
(probably) and reflects the suspected date of compromise/loss/etc. 
There is no constraint on the invalidity date (it can definitely precede
the last CRL).

Dave