>> A possible work around I can see here is to allow for some time between
>> steps 3 and 4 of the process described in the res-certs document, and
>> publish the NEW certificate before activating it. This could give
>> relying parties time to use the new certificate as another TA next to
>> the 'current' certificate. But like I said, I think this makes the whole
>> system more complicated.
>
> Correct, but my point was that during that time you need to publish all
> signed materials under both CAs, the OLD and the CURRENT.
I disagree here Roque. You may want to think carefully about the AIA pointers
of the subordinate certificates, and think about why the documented procedure
says:
5. The CURRENT CA will generate new certificates for
all existing subordinate CA and EE certificates,
and publish those products in the same repository
publication point and with the same repository
publication point name as the previous OLD
subordinate CA and EE certificates. The keys in
these reissued certificates must not change.
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
