Managing Long-Lived CA certs
"Dr. Pala" <[email protected]>
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Organization | OpenCA Labs |
| Message-ID | <[email protected]> |
Hi PKIX, I have a small question for the list regarding long-lived CA certificates. Especially in the context of device certificates, we often see the use of extra long-lived certificates for Root and Sub CAs (e.g., 35+ years) combined with limited key sizes (e.g., p256). Until we have a supported mechanism for reprovisioning devices (...), one possible solution for limiting the exposure of the private key would be to have a scoped certificate issuance period. What I am thinking about would be adding an extension that says: "This CA can issue certificates from up to 5 years from the validFrom, after this, just use it to provide revocation information". This might provide some protection in case the CA key is compromised after the initial 5 years of validity (e.g., certificates issued after that date shall be rejected). Does such extension exists today ? If not, could this be some work for LAMPS/SPASM WG ? Cheers, Max -- Best Regards, Massimiliano Pala, Ph.D. OpenCA Labs Director OpenCA Logo _______________________________________________ pkix mailing list [email protected] https://www.ietf.org/mailman/listinfo/pkix