Subject: Questions on Root CA key Update in rfc2510 (CMP)

From: "Sergio Tabanelli" <[email-masked]>
Date: Thu, 11 Mar 1999 15:19:05 +0100

I am sure I am missing something. Reading 2.4.1 "Ca operator actions"
of the rfc2510 (CMP), a big question comes into my mind.

How is it possible to verify with the NEW CA CERTIFICATE an EE certificate
signed with the OLD CA KEY  when the OLDWITHNEW certificate has expired
(I understand from 2.4.1 that the validity period of OLDWITHNEW ends
"at the expiry date of the old public key", i.e. at the same time as OLD.
What does exactly mean "correct" and "check" in 2.4.2.2?

"2. Verify that this is correct ......... 3. If correct, check the signer's
certificate using the old CA"
Is the EE Certificate verification a normal path validation as explained in
rfc2459?

Thanks for any answer.
Sergio Tabanelli
[email-masked]

---

From: Juergen Walter <[email-masked]>
Date: Thu, 11 Mar 1999 19:16:40 +0100

Sergio,

> What does exactly mean "correct" and "check" in 2.4.2.2?

I think the RFC is correct in this point. When the old CA´s KEY expires
then all EE certificates signed with the old key become invalid. All EE
who have a certificate signed with the old CA´s key need a new
certificate prior to expiration date of the old CA´s key.

Following figure may help. Hopefully it will be received well formated
:-)

I---OLDwithOLD---I I---NEWwithNEW---------I   )   
             I---OLDwithNEW---I               ) CA certificates
             I---NEWwithOLD---I               )
                    
                              I               ) date of CA´s old key
expiration
             I                                ) date of CA´s new key
generation
                      
                    I---EE2withNEW---I        )
      I---EE1withOLD---I                      ) EE certificates
                       I---EE1withNEW---I
Note there is a difference between OLDwithOLD certificate´s expiration
and CA´s old KEY expiration. Furthermore the CA has two keys during a
certain period.

> Is the EE Certificate verification a normal path validation as explained in

Note the "Bug in rfc2459" discussion recently on this mailing list.
Personally, I tend to incorrect certificate path validation defined by
RFC 2459.

-- 

with regards

--------------------------------------------------------------------
Juergen Walter                  
DEH information systems GmbH    WWW: http://www.deh.de
Weissenfelser Strasse 46a       Germany
D-06217 Merseburg               Tel.: +49 3461 3318-25
Email: [email-masked]            Fax:  +49 3461 415072
--------------------------------------------------------------------