Subject: Re: Certificate Validity Problem

From: Jean-Marc Desperrier <[email-masked]>
Date: Mon, 02 Jan 2006 23:16:39 +0100

santosh chokhani wrote:
> If the cryptanalysis or compromise of expired keys is not a concern, one
> could do cumulative CRL using an X.509 extension (3280 does not have this)
> stating that the CRL contains expired certificates.
>   
I'm replying a bit late, but IMO that extension from X.509 (2005) 
(expiredCertsOnCRL) would be a very useful addition to rfc 3280bis.

If the motivation for not including it is to keep the document small, I 
can make a list of much less needed elements to remove :-)