Confirmed users, Administrators
5,526
edits
CA/Revocation Reasons: Difference between revisions
Jump to navigation
Jump to search
Incorporating feedback
(continued drafting text) |
(Incorporating feedback) |
||
| Line 8: | Line 8: | ||
* There were no policies specifying the information that CAs should provide to their certificate subscribers about revocation reasons | * There were no policies specifying the information that CAs should provide to their certificate subscribers about revocation reasons | ||
TLS Certificates may be revoked ONLY for one of the following reasons: | |||
* unspecified (RFC 5280 CRLReason #0) | |||
* keyCompromise (RFC 5280 CRLReason #1) | * keyCompromise (RFC 5280 CRLReason #1) | ||
* affiliationChanged (RFC 5280 CRLReason #3) | |||
* superseded (RFC 5280 CRLReason #4) | |||
* cessationOfOperation (RFC 5280 CRLReason #5) | |||
* privilegeWithdrawn (RFC 5280 CRLReason #9) | * privilegeWithdrawn (RFC 5280 CRLReason #9) | ||
* | |||
The CRL reasonCode extension must be used when any of the following reasons are used: | |||
* keyCompromise (RFC 5280 CRLReason #1) | |||
* affiliationChanged (RFC 5280 CRLReason #3) | * affiliationChanged (RFC 5280 CRLReason #3) | ||
* superseded (RFC 5280 CRLReason #4) | * superseded (RFC 5280 CRLReason #4) | ||
* cessationOfOperation (RFC 5280 CRLReason #5) | |||
* privilegeWithdrawn (RFC 5280 CRLReason #9) | |||
If the reason for revocation is unspecified (RFC 5280 CRLReason #0), the CRL reasonCode for that entry must be omitted. | |||
== Communication to Subscribers == | == Communication to Subscribers == | ||