Subject: Re: RFC3280bis: NotAfter 99991231235959Z

From: "Julien Stern" <[email-masked]>
Date: Wed, 15 Nov 2006 18:28:23 +0100

On Wed, Nov 15, 2006 at 09:55:47AM -0500, Russ Housley wrote:
> 
> I would like to add some text about certificates that are not 
> intended to expire.  I propose the following paragraph.
> 
> In some situations, devices are given permanent certificates.  For 
> example, a device could be issued a certificate that binds its model 
> and serial number to its public key.  Such a certificate is intended 
> to be used for the entire lifetime of the device.  It indicate the 
> permanent nature of such a certificate, the notAfter SHOULD be 
> assigned the GeneralizedTime value of 99991231235959Z.
> 
> Any concerns?

If the device is somehow stolen or compromised at some point,
doesn't this mean that you will have to keep its serial number in a CRL
(or an other revocation system) until the end of times?

When faced with a somehow similar issue, we decided to set the date to
the expected lifetime of the device plus a few years to avoid the above
issue.

--
Julien

---

From: Russ Housley <[email-masked]>
Date: Wed, 15 Nov 2006 15:09:28 -0500

No.  That device is still that device.  The certificate is not making 
any statement about the ownership of the device.

Russ