Re: [lamps] Renewing (short lived) certs with EST (RFC7030) [was: Re: Sean: Permissibility of expired cert renewal]

Jim Schaad <> Thu, 30 August 2018 17:25 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8567C130DE8; Thu, 30 Aug 2018 10:25:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id mSaiLRwDooqo; Thu, 30 Aug 2018 10:25:31 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D1946130DE6; Thu, 30 Aug 2018 10:25:30 -0700 (PDT)
Received: from Jude ( by ( with Microsoft SMTP Server (TLS) id 15.0.1347.2; Thu, 30 Aug 2018 10:21:12 -0700
From: Jim Schaad <>
To: 'Michael Richardson' <>, 'Sean Turner' <>
CC: <>, <>, 'Toerless Eckert' <>
References: <> <> <> <> <19312.1535640189@localhost>
In-Reply-To: <19312.1535640189@localhost>
Date: Thu, 30 Aug 2018 10:25:00 -0700
Message-ID: <051f01d44086$639dac60$2ad90520$>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQJs0N/D/l5NoTpYLg93tf6KU6JktQGtF0yUAqwrFxwB3DikzQGoMb9Ao2h8upA=
Content-Language: en-us
X-Originating-IP: []
Archived-At: <>
Subject: Re: [lamps] Renewing (short lived) certs with EST (RFC7030) [was: Re: Sean: Permissibility of expired cert renewal]
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 30 Aug 2018 17:25:34 -0000

One of the issues that you need to make sure to include is that revocation information must be kept by the EST server until the point in time that the expired certificate would not be permitted to be used for authentication.  There is currently on a requirement that this information be kept by the server until "the first CRL after the certificate expired as been issued."  


> -----Original Message-----
> From: Spasm <> On Behalf Of Michael Richardson
> Sent: Thursday, August 30, 2018 7:43 AM
> To: Sean Turner <>
> Cc:;; Toerless
> Eckert <>
> Subject: Re: [lamps] Renewing (short lived) certs with EST (RFC7030) [was: Re:
> Sean: Permissibility of expired cert renewal]
> Sean Turner <> wrote:
>     >> Seems to leave 5280 as the existing doc standing in the way ?
>     >> If so, how to most easily fix this ?
>     > I think what you’re after is an explicit statement that says you’re
>     > free to use an expired certificate to request a new certificate? If
>     > you’re looking for that to be added to RFC 5280 I’d say good luck
>     > because it’s policy specific thing.
> I think that what we want to do is write a Security Considerations for renewing
> certificates using EST with an expired certificate as
> authentication.    We need to outline what kinds of policy might be required,
> and when it would be approrpriate not to accept specific certificates, or when it
> might be appropriate to accept no expired certificates (perhaps for an interval
> of time).  Or just how old (as a percentage of cert life) is too old.
> I think that the threat case here is that devices are inappropriately disposed of
> (vulnerable to dumpster diving or ebay acquisition), with the assumption that
> the credentials are old and do not need to be wiped.
> Probably there are other threat cases that I have not thought of, and I think that
> the goal would be to write the threats down... ideally to give them names.
> --
> Michael Richardson <>ca>, Sandelman Software Works  -
> = IPv6 IoT consulting =-