Subject: Forward-dated entries in a CRL

From: "Salz, Rich" <[email-masked]>
Date: Tue, 16 Nov 1999 12:11:49 -0500

Is it legal to put future date in the revocationDate
field of a revokedCertificates entry?

---

From: Sharon Boeyen <[email-masked]>
Date: Thu, 18 Nov 1999 08:45:38 -0500

There was a ballot comment from Japan on this same issue at last month's
X.509 meeting. The resolution of that
comment at that meeting was that no, the current standard requires that any
certificate listed on a CRL be 
a certificate that HAS BEEN revoked. The delegation from Japan was going to
revist their requirement to determine
for sure whether they needed the ability to actually get revocation notices
into the hands of relying parties before
revocation occured (e.g. scheduled employee departures) or to have the CA
prepare in advance to issue a CRL when 
the revocations occur. Their example had to do a mass revocation of numerous
certificates at the same time.

If their requirement is for the former, then they may submit a new work
proposal on the topic. If you have requirements
for future dates, I'd be interested in hearing them to see how they relate
to the X.509 discussion of the Japanese 
requirements.

Sharon

---

From: Russ Housley <[email-masked]>
Date: Thu, 18 Nov 1999 09:04:34 -0500

Rich:

No.  RFC 2459 says:

    The invalidity date is a non-critical CRL entry extension that
    provides the date on which it is known or suspected that the private
    key was compromised or that the certificate otherwise became invalid.

Since the extension is non-critical, a certificate user can ignore 
it.  Thus, any entry on the CRL is treated as revoked at the time it is put 
on the list.

Russ

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 18 Nov 1999 10:09:22 -0500

Thanks.
 
The question came up here during testing when someone  somewhere found or
generated a CRL with a post-dated entry.  As an implementor I'm glad that
such things are illegal; as a user, I concur with the Japanese delegation
that they can be useful.
    /r$