Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

[[e-mail] (Martin Rex)]

Erwann Abalea wrote:
> 
> RFC5280 doesn't say anything about the meaning of revocation reason codes.
> X.509 do, in 8.5.2.2:
> "A certificate may be placed on hold by issuing a CRL entry with a reason
> code of certificateHold. The certificate hold
> notice may include an optional hold instruction code to convey additional
> information to certificate users (see 8.5.2.3)."

Now you're kidding me.

We're talking about the semantics of the "certificateHold" status.
A protocol element without semantics would be utterly useless.

And the text that you quote gives a STRONG HINT that this status
was intended to have a rather broad meaning, and not only the
narrow meaning of two specific usage cases that you mentioned
(token lost, or new token in the mail).

-Martin