Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

[[e-mail] (Martin Rex)]

Followup to myself (to clarify):

Martin Rex wrote:
> Stefan Santesson wrote:
> > 
> > Those fields are not treated in any special way depending on what status
> > you provide in a response.
> 
> I agree that there is intentionally *no* special treatment for thisUpdate
> and nextUpdate, i.e. they should probably be similar to traditional
> situations when certificateHold appears on a CRL.
> 
> But since this synthesized "certificateHold" revocation for a not-issued
> certificate does not originate from a CRL, an implementor might wonder
> what to put into these fields when changing existing code, in particular
> existing code that would copy values from the CRL for "certficateHold"
> that originates from a CRL.
> 
> Anyhow, I think that rfc2560bis can not (and should not) make suggestions
> for specific values.  What values would your OCSP implementation use for
> "good" or "unknown" responses for the same CA?  Those values look like
> they might be from the right ballpark.

I meant "suggestion for _one_ specific value".  Providing a more general
guidance what might be an appropriate value would be fine.

 
-Martin