Re: Putting a certificate on hold with CMP (and removing it)

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Teemu Alakoski <teemu.alakoski@xxxxxxxx> writes:

>To my understanding, CMP can be used to put a certificate on hold using
>crlEntryDetails field of the RevReqContent structure. This is achieved by
>using a crlEntryDetails that contains a certificateHold CRLReason. Is it,
>however, possible to remove the hold status from a certificate with CMP?

It's not even certain how to do this *without* CMP, there are a pile of
different (mostly incompatible) opinions on how certificate holds are actually
supposed to work in practice.  Once you add CMP to the mix, all bets are off.
If your implementation supports handling of this, the quick answer is to do
whatever the implementation requires.

(Insert additional paragraphs that contain the word "policy" in every other
 sentence).

Peter.