Subject: RE: on-hold certificates in CRLs

From: Sharon Boeyen <[email-masked]>
Date: Thu, 30 Nov 2006 11:31:16 -0500

Stephen, I tend to agree with you on this one. Suspension (in my opinion -
as editor of X.509 for a number of years) was originally intended simply as
a way for a CA to temporarily revoke a certificate in a situation where the
CA needed to do further investigation to determine whether or not it should
actually be revoked. Once that investigation was completed, the final status
of the certificate is indicated either by removing it from the CRL
(indicating that it was actually fine) or changing its revocation reason to
the real one. Nothing more and nothing less. As for "interpretations" I do
agree there are many as with many other parts of X.509 and RFC 3280.
However, that doesn't mean we should change the standard.

Cheers,
Sharon 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Stephen Farrell
Sent: Thursday, November 30, 2006 8:13 AM
To: pkix
Subject: Re: on-hold certificates in CRLs

Wen-Cheng Wang wrote:
> Yes, I second that we should start a working item on a reliable,
> verifiable, and
> interoperabile suspension mechanism.

Count me as a -1 for that. I don't believe we do want a suspension mechanism
really.

Stephen.

---

From: "Michael Myers" <[email-masked]>
Date: Thu, 30 Nov 2006 09:23:40 -0800

RE: on-hold certificates in CRLsI too agree with Stephen.  Whether listed as
suspended or revoked, from a relying party perspective certificates
proffered in either state are not trustworthy.  Rather than legitimize a
questionable interpretation, I think we should strive for simplicity and
thus not move forward on a work item in this regard.

Mike
  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On
Behalf Of Sharon Boeyen
  Sent: Thursday, November 30, 2006 8:31 AM
  To: 'Stephen Farrell'; pkix
  Subject: RE: on-hold certificates in CRLs

  Cheers,
  Sharon

  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Farrell
  Sent: Thursday, November 30, 2006 8:13 AM
  To: pkix
  Subject: Re: on-hold certificates in CRLs

  > interoperabile suspension mechanism.

  Count me as a -1 for that. I don't believe we do want a suspension
mechanism really.

  Stephen.