At 8:28 AM -0800 1/23/08, Terwilliger, Ann wrote:
Actually we do use suspension. It gives us a means of preventing the certificate from being relied upon (assuming of course that the relying party application recognizes the 'on hold' entry in the CRL) while we complete the investigation to see if there really is a valid reason to revoke the certificate. By suspending the certificate we still have the option to reinstate it without requiring the certificate requestor to generate a new key pair/certificate request.
A new cert request need not entail a new key pair. The bundling of these two makes the process more painful for the Subject, and thus provides greater justification for suspension vs. revocation, but such bundling is NOT required by the standards.
Steve