RE: Conclusions: CA Rekey and CRL Validation

["Alberti Antoine" <aalberti@xxxxxxxxx>]

Because a CA MAY change DN when renewing its key ?

> -----Message d'origine-----
> De : owner-ietf-pkix@xxxxxxxxxxxx
> [mailto:owner-ietf-pkix@xxxxxxxxxxxx]De la part de Luciano (Pessoal)
> Envoyé : vendredi 17 septembre 2004 16:59
> À : ietf-pkix@xxxxxxx
> Objet : Conclusions: CA Rekey and CRL Validation
> 
> 
> 
> After all this discursion, it is correct affirm:
> 
> 1) To do a CA-Rekey it is not necessary change the CA's DN.
> 
> 2) The "newer CA" can issue CRLs that contain revocation informations
> about all the certificates issued using the new and the old key.
> 
> 3) It is not necessary mantain the older CA key for issuing CRLs that
> contain only revocation informations about certificates 
> issued using the
> old key (neither containing revocation info about 
> certificates issued by
> the "newer CA").
> 
> 4) A certificate issued by the "older CA" can be validated 
> using the CRL
> issued by the "newer CA", without be considered a security problem.
> 
> 5) For all the aspects of X509 and RFC 3280, the "newer CA" and the
> "older CA" are considered the SAME CA.
> 
> 
> Thank you,
> 
> Luciano Coelho
> 
>