Re: [pkix] New draft-ietf-pkix-rfc2560bis-06

[Erwann Abalea <[e-mail]>]

2012/10/23 Martin Rex <[e-mail]>

> Denis Pinkas wrote:
> >
> > The certificateHold state was not created to have certificates issued
> > in a suspended state. It was created to allow a user to suspend its
> > certificates rather than revoking its certificates, in case a smart
> > card was temporarily lost and since after a revocation it may take
> > a while to get a new smart card.
> >
> > Some people, then used also the certificateHold state to have
> > certificates issued in a suspended state. This is legitimate since
> > it complies with the semantics of the certificateHold state.
> >
> > We should not change/overload the meaning of CertificateHold.
>
>
> The purpose of the CertificateHold is to convey from the CA to the RP
> "you should not currently trust the certificate with this serial,
> because it is not certain that the entity which is currently
> in control of the associated private key is actually the entity
> which the cert says it is."
>

RFC5280 doesn't say anything about the meaning of revocation reason codes.
X.509 do, in 8.5.2.2:
"A certificate may be placed on hold by issuing a CRL entry with a reason
code of certificateHold. The certificate hold
notice may include an optional hold instruction code to convey additional
information to certificate users (see 8.5.2.3)."

-- 
Erwann.