Re: [pkix] review of draft-ietf-pkix-rfc2560bis-15

[[e-mail] (Martin Rex)]

Piyush Jain wrote:
>  
> > Anyhow, I think that rfc2560bis can not (and should not) make suggestions
> > for specific values.  What values would your OCSP implementation use for
> > "good" or "unknown" responses for the same CA?  Those values look like
> > they might be from the right ballpark.
> 
> 2560-bis states that these values correspond to those in CRLs.
> Implementations that I know of set these values from the CRL for good
> responses and use current time for unknown responses.
> 
> This is how 2560 defines these fields
> - thisUpdate: The time at which the status being indicated is known  to be
> correct
>  - nextUpdate: The time at or before which newer information will be
> available about the status of the certificate
> 
> So for non-issued, thisUpdate should be start of CAs validity interval (all
> certs are revoked until they get issued) and nextUpdate should be current
> time (a certificate with that serial can be issued anytime). 

Fine with me.

What I meant (and failed to clarify) is that rfc2560bis should not define
special values for thisUpdate/nextUpdate that are specific to the
"not issued reported as revoked/certificateHold" situation.

-Martin