Subject: [pkix] Question about RFC 7030 - Enrollment over Secure Transport

From: Reilly James <[email-masked]>
Date: Fri, 22 May 2020 10:55:08 +0000

Hello

We are looking at RFC 7030 - Enrollment over Secure Transport.

Is there a reason or thought process in section '4.1.3 CA Certificates Response'

   'The EST server SHOULD include the three "Root CA Key Update"
   certificates OldWithOld, OldWithNew, and NewWithOld in the response
   chain.  These are defined in Section 4.4 of CMP [RFC4210].'

why SHOULD rather than example MUST was used in the specification by the authors?

James