|
Posted by Dave Wø6¯ygb±Ë¬²*'²hœ®‹(~×( on July 8, 2005, 7:41 am
Please log in for more thread options
Could someone explain how a CA continues to sign a CRL for certificates that
it issued with a particular CA signing key pair, once that key pair has
expired. My understanding of the Windows CA is that the CA signing key that
was used to sign a certificate must be used to sign the CRL upon which that
certificate would "potentially" appear.
I know that a CA cannot sign certificates with a lifetime that is equal or
greater than the CA's signing key pair, but I'm considering a situation where
the CA signing key pair needs to be rekeyed due to a suspected compromise.
Regards,
Dave
| 
XML Sitemap