Re: Managing Long-Lived CA certs
Rob Stradling <[email protected]>
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Message-ID | <[email protected]> |
Hi Max. The "Private Key Usage Period" extension was present in RFC2459 and RFC3280 (see section 4.2.1.4), but was removed in RFC5280. (Well, mostly removed; the ASN.1 definitions are still in Appendix A.2 ;-) ). On 17/07/17 15:19, Dr. Pala wrote: > Hi PKIX, > > I have a small question for the list regarding long-lived CA > certificates. Especially in the context of device certificates, we often > see the use of extra long-lived certificates for Root and Sub CAs (e.g., > 35+ years) combined with limited key sizes (e.g., p256). > > Until we have a supported mechanism for reprovisioning devices (...), > one possible solution for limiting the exposure of the private key would > be to have a scoped certificate issuance period. > > What I am thinking about would be adding an extension that says: "This > CA can issue certificates from up to 5 years from the validFrom, after > this, just use it to provide revocation information". This might provide > some protection in case the CA key is compromised after the initial 5 > years of validity (e.g., certificates issued after that date shall be > rejected). > > Does such extension exists today ? If not, could this be some work for > LAMPS/SPASM WG ? > > Cheers, > Max > > -- > Best Regards, > Massimiliano Pala, Ph.D. > OpenCA Labs Director > OpenCA Logo > > > _______________________________________________ > pkix mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/pkix > -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online _______________________________________________ pkix mailing list [email protected] https://www.ietf.org/mailman/listinfo/pkix