Policy-Discussion

[Ian G <iang AT cacert.org>]

On 14/11/11 03:36 AM, Michael Tänzer wrote:

To get somewhere in the key extension issue I call for the following vote:


It is resolved that the CPS section 7.1.2 is changed as stated on
https://wiki.cacert.org/PolicyDrafts/CPSKeyUsageChanges


Voting should be open for one week (i.e. until 2011-11-21) as it is
merely technical details not a fundamental change to the policy.

Regards,

crlDistributionPoints=URI:<crlUri>

following on from discussions in NewRootsTaskForce we have surmised whether to get rid of CRLs in the future, as OCSP gives us a much better mechansim to deal with disaster recovery.

But this would also involve dropping CRLs.  And not putting the URI in the certs.

Whether this is a good thing or a bad thing I'm unsure, but I note that Baseline Requirements (Draft 50, which has just come out 2 hours ago) goes some way in this direction.

http://www.gerv.net/temp/Baseline_Requirements_Draft_50.pdf section 13.2.2.  OCSP is like SHALL, and CRLs are like an IF.  Although the text is typically unclear....


iang



PS: for NewRootsTaskForce, note the full text in that PDF above.  PPS: for all;  the intention is that BR will be a new compliance document applying to all CAs.
It is being voted forward in CABForum in about 5 days.