[pkix] Managing Long-Lived CA certs

["Dr. Pala" <[e-mail]>]

Hi PKIX,

I have a small question for the list regarding long-lived CA 
certificates. Especially in the context of device certificates, we often 
see the use of extra long-lived certificates for Root and Sub CAs (e.g., 
35+ years) combined with limited key sizes (e.g., p256).

Until we have a supported mechanism for reprovisioning devices (...), 
one possible solution for limiting the exposure of the private key would 
be to have a scoped certificate issuance period.

What I am thinking about would be adding an extension that says: "This 
CA can issue certificates from up to 5 years from the validFrom, after 
this, just use it to provide revocation information". This might provide 
some protection in case the CA key is compromised after the initial 5 
years of validity (e.g., certificates issued after that date shall be 
rejected).

Does such extension exists today ? If not, could this be some work for 
LAMPS/SPASM WG ?

Cheers,
Max

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo