Section 2.2 of the BRs says: "The CA SHALL host test Web pages that allow Application Software Suppliers to test their software with Subscriber Certificates that chain up to each publicly trusted Root Certificate. At a minimum, the CA SHALL host separate Web pages using Subscriber Certificates that are (i) valid, (ii) revoked, and (iii) expired."
Mozilla requires these 3 URLs as part of the annual updates to the CCADB. We want to make it clear (and have done so on https://wiki.mozilla.org/CA:CommonCADatabase#How_To_Provide_Annual_Updates ) that we consider this requirement to be more fully specified as: * valid = unexpired and unrevoked * revoked = unexpired, and present in either/both of CRL and OCSP * expired = notAfter less than the current day, and unrevoked In particular, please make sure your revoked certificate is _un_expired. If people think the BRs need updating to clarify this, we could draft a ballot. Gerv _______________________________________________ Public mailing list [email protected] https://cabforum.org/mailman/listinfo/public
