[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Revocation.
Ben Laurie asks:
> The next question, though, is, if it is after the good-until date, but I
> can't, or won't, check the cert, what is its status? If it is OK to use
> the cert anyway, then why have it (good-until, that is), and if it
> isn't, then how is it different from the not-after date?
The main point is (and see my paper for emphasis) is that it should be
the RECEIVER who decides when a certificate is recent enough, NOT THE
ISSUER. The issuer can only inform the receiver that it is guaranteed
not to go bad during the initial period. But the receiver knows what
is at risk if he accepts a bad certificate, and so can make the decision
if it is OK to accept a ``probably OK'' certificate, or whether he really
wants a ``guaranteed OK'' certificate.
If the receiver decides he needs a more recent (e.g. guaranteed) cert,
and the issuer fails to respond to a check, then the receiver should
fail to accept.
Cheers,
Ron