Re: Conclusions: CA Rekey and CRL Validation

[Jean-Marc Desperrier <jmdesp@xxxxxxx>]

Luciano (Pessoal) wrote:

> 2) The "newer CA" can issue CRLs that contain revocation informations
> about all the certificates issued using the new and the old key.
>  
I don't like this 'can' :-)

It's ***MUST*** issue CRLs [...] about *ALL* the certificates issued 
using the new and the old key 

> 3) It is not necessary mantain the older CA key for issuing CRLs that
> contain only revocation informations about certificates issued using the
> old key (neither containing revocation info about certificates issued by
> the "newer CA").
>  
It's not necessary, but you may need it for applications that do not 
support verification of CRL with a key different from the key that 
signed the certificate.

In which case : The older CA key ***MUST*** issue CRLs [...] about *ALL* 
the certificates issued using the new and the old key