Re: Online Certificate Revocation Protocol

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Tony Bartoletti <azb@xxxxxxxx> writes:

>Assuming that the entity which lost their private key wanted another
>certificate with a new key pair but wanted the same name. What would
>happen if their were two certificates in existance with the same name?
>Wouldn't the CA not allow this? 
 
CMP already does this via key update request handling, which issues a new cert 
which duplicates an existing one (and having had to implement this I can tell 
you that it's a right bastard to do if your CA has built-in security rules to 
prevent this situation from occurring).
 
Peter.