Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

[[e-mail] (Martin Rex)]

Denis Pinkas wrote:
> 
> The certificateHold state was not created to have certificates issued
> in a suspended state. It was created to allow a user to suspend its
> certificates rather than revoking its certificates, in case a smart
> card was temporarily lost and since after a revocation it may take
> a while to get a new smart card.
> 
> Some people, then used also the certificateHold state to have
> certificates issued in a suspended state. This is legitimate since
> it complies with the semantics of the certificateHold state.
> 
> We should not change/overload the meaning of CertificateHold.


The purpose of the CertificateHold is to convey from the CA to the RP
"you should not currently trust the certificate with this serial,
because it is not certain that the entity which is currently
in control of the associated private key is actually the entity
which the cert says it is." 

When an OCSP responder has access to the certificate issue logs,
and does not find proof that a requested serial was issued,
then the message it wants to convey to the RP is
"you should not currently trust the certificate with this serial,
because it is not certain that the entity which is currently
in control of the associated private key is actually the entity
which the cert says it is."

So we are *NOT* changing nor overloading the semantics of CertificateHold
_at_all_ with this expanded definition !


-Martin

"