RE: OCSP and CSL

[Ambarish Malpani <ambarish@xxxxxxxxxxxx>]

Hi Mirko,
    Most commercial software does not remove expired, revoked
certs from their CRLs, but there have already been requests
for that behavior. Expect to see it in CA products this year.

Regards,
Ambarish

> -----Original Message-----
> From: Mirko Tedaldi [mailto:mirko@coine.it]
> Sent: Wednesday, February 02, 2000 6:36 AM
> To: Ilan Shacham
> Cc: ietf-pkix@imc.org
> Subject: RE: OCSP and CSL
> 
> 
> At 14.30 02/02/00 +0200, Ilan Shacham wrote:
> 
> >Section 3.3 of RFC 2459 clearly states:
> >         An entry may be removed from
> >    the CRL after appearing on one regularly scheduled CRL 
> issued beyond
> >    the revoked certificate's validity period.
> >
> >If you want to validate an "old" signature, all you have to do is
> >retrive the crl that was in order at the time of the signature, to
> >see if the certificate was valid at the time.
> 
> About it, do you know how commercial PKI softwares work? Do 
> they remove 
> expired certificates from CRL ?
> 
> Mirko Tedaldi.
>