[cabfpub] 9.6.3 and Private Key use

Gervase Markham gerv at mozilla.org
Tue Jun 21 10:14:10 UTC 2016


On 20/06/16 19:28, Ben Wilson wrote:
> Reporting and Revocation: An obligation and warranty to:  (a)
> promptly cease using a Certificate and its associated Private Key if
> there is any actual or suspected misuse or compromise of the
> Subscriber’s Private Key associated with the Public Key included in
> the Certificate; and (b) to promptly request the CA to revoke the
> Certificate, in the event of (a), or if any information in the
> Certificate is, or becomes, incorrect or inaccurate.

This is definitely the right sentiment, although the (a) ... (b) ... (a)
makes it a bit hard to parse. How about:

Reporting and Revocation: An obligation and warranty to:

(a) promptly request revocation of the Certificate, and cease using it
and its associated Private Key, if there is any actual or suspected
misuse or compromise of the Subscriber’s Private Key associated with the
Public Key included in the Certificate; and

(b) promptly request revocation of the Certificate, and cease using it,
if any information in the Certificate is or becomes incorrect or inaccurate.

Gerv



More information about the Public mailing list