From d6ce87913f2724a338540dc9603acb3362e9969c Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 14:26:38 -0400 Subject: [PATCH 01/10] Update BR.md --- docs/BR.md | 42 +++++++++++++++--------------------------- 1 file changed, 15 insertions(+), 27 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 5298d38a..c398b00c 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1492,26 +1492,15 @@ The CA MAY support revocation of Short-lived Subscriber Certificates. With the exception of Short-lived Subscriber Certificates, the CA SHALL revoke a Certificate within 24 hours and use the corresponding CRLReason (see Section 7.2.2) if one or more of the following occurs: -1. The Subscriber requests in writing, without specifying a CRLreason, that the CA revoke the Certificate (CRLReason "unspecified (0)" which results in no reasonCode extension being provided in the CRL); -2. The Subscriber notifies the CA that the original certificate request was not authorized and does not retroactively grant authorization (CRLReason #9, privilegeWithdrawn); -3. The CA obtains evidence that the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise (CRLReason #1, keyCompromise); -4. The CA is made aware of a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate, including but not limited to those identified in [Section 6.1.1.3(5)](#6113-subscriber-key-pair-generation) (CRLReason #1, keyCompromise); -5. The CA obtains evidence that the validation of domain authorization or control for any Fully-Qualified Domain Name or IP address in the Certificate should not be relied upon (CRLReason #4, superseded). +1. The CA obtains evidence that the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise OR the CA is made aware of a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. (CRLReason #1, keyCompromise) +2. The CA obtains evidence that the validation of domain authorization, control for any Fully-Qualified Domain Name or IP address in the Certificate, or CA Authorization Record relied upon during issuance should not be relied upon. (CRLReason #3, affiliationChanged) With the exception of Short-lived Subscriber Certificates, the CA SHOULD revoke a certificate within 24 hours and MUST revoke a Certificate within 5 days and use the corresponding CRLReason (see Section 7.2.2) if one or more of the following occurs: -6. The Certificate no longer complies with the requirements of [Section 6.1.5](#615-key-sizes) and [Section 6.1.6](#616-public-key-parameters-generation-and-quality-checking) (CRLReason #4, superseded); -7. The CA obtains evidence that the Certificate was misused (CRLReason #9, privilegeWithdrawn); -8. The CA is made aware that a Subscriber has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use (CRLReason #9, privilegeWithdrawn); -9. The CA is made aware of any circumstance indicating that use of a Fully-Qualified Domain Name or IP address in the Certificate is no longer legally permitted (e.g. a court or arbitrator has revoked a Domain Name Registrant's right to use the Domain Name, a relevant licensing or services agreement between the Domain Name Registrant and the Applicant has terminated, or the Domain Name Registrant has failed to renew the Domain Name) (CRLReason #5, cessationOfOperation); -10. The CA is made aware that a Wildcard Certificate has been used to authenticate a fraudulently misleading subordinate Fully-Qualified Domain Name (CRLReason #9, privilegeWithdrawn); -11. The CA is made aware of a material change in the information contained in the Certificate (CRLReason #9, privilegeWithdrawn); -12. The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA's Certificate Policy or Certification Practice Statement (CRLReason #4, superseded); -13. The CA determines or is made aware that any of the information appearing in the Certificate is inaccurate (CRLReason #9, privilegeWithdrawn); -14. The CA's right to issue Certificates under these Requirements expires or is revoked or terminated, unless the CA has made arrangements to continue maintaining the CRL/OCSP Repository (CRLReason "unspecified (0)" which results in no reasonCode extension being provided in the CRL); -15. Revocation is required by the CA's Certificate Policy and/or Certification Practice Statement for a reason that is not otherwise required to be specified by this section 4.9.1.1 (CRLReason "unspecified (0)" which results in no reasonCode extension being provided in the CRL); or -16. The CA is made aware of a demonstrated or proven method that exposes the Subscriber's Private Key to compromise or if there is clear evidence that the specific method used to generate the Private Key was flawed (CRLReason #1, keyCompromise). - +3. The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA's Certificate Policy or Certification Practice Statement. (CRLReason #5, cessationOfOperation) +4. The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. (CRLReason #9, privilegeWithdrawn) +5. The Subscriber requests in writing, without specifying a CRLreason, that the CA revoke the Certificate, or for any other purpose. (CRLReason #0, unspecified) + #### 4.9.1.2 Reasons for Revoking a Subordinate CA Certificate The Issuing CA SHALL revoke a Subordinate CA Certificate within seven (7) days if one or more of the following occurs: @@ -3602,20 +3591,19 @@ Table: crlEntryExtensions Component | __CRL Entry Extension__ | __Presence__ | __Description__ | | --- | -- | ----- | -| `reasonCode` | * | When present (OID 2.5.29.21), MUST NOT be marked critical and MUST indicate the most appropriate reason for revocation of the Certificate.

MUST be present unless the CRL entry is for a Certificate not technically capable of causing issuance and either 1) the CRL entry is for a Subscriber Certificate subject to these Requirements revoked prior to July 15, 2023 or 2) the reason for revocation (i.e., reasonCode) is unspecified (0).

See the "CRLReasons" table for additional requirements. | +| `reasonCode` | * | When present (OID 2.5.29.21), MUST NOT be marked critical and MUST indicate the most appropriate reason for revocation of the Certificate.

MUST be present unless the reason for revocation (i.e., reasonCode) is unspecified (0).

See Section 4.9.1 for additional requirements. | | Any other value | NOT RECOMMENDED | - | Table: CRLReasons -| __RFC 5280 reasonCode__ | __RFC 5280 reasonCode value__ | __Description__ | -| --- | - | ------ | -| unspecified | 0 | Represented by the omission of a reasonCode. MUST be omitted if the CRL entry is for a Certificate not technically capable of causing issuance unless the CRL entry is for a Subscriber Certificate subject to these Requirements revoked prior to July 15, 2023. -| keyCompromise | 1 | Indicates that it is known or suspected that the Subscriber’s Private Key has been compromised. | -| affiliationChanged | 3 | Indicates that the Subject's name or other Subject Identity Information in the Certificate has changed, but there is no cause to suspect that the Certificate's Private Key has been compromised. | -| superseded | 4 | Indicates that the Certificate is being replaced because: the Subscriber has requested a new Certificate, the CA has reasonable evidence that the validation of domain authorization or control for any fully‐qualified domain name or IP address in the Certificate should not be relied upon, or the CA has revoked the Certificate for compliance reasons such as the Certificate does not comply with these Baseline Requirements or the CA's CP or CPS. | -| cessationOfOperation | 5 | Indicates that the website with the Certificate is shut down prior to the expiration of the Certificate, or if the Subscriber no longer owns or controls the Domain Name in the Certificate prior to the expiration of the Certificate. -| certificateHold | 6 | MUST NOT be included if the CRL entry is for 1) a Certificate subject to these Requirements, or 2) a Certificate not subject to these Requirements and was either A) issued on-or-after 2020-09-30 or B) has a `notBefore` on-or-after 2020-09-30. -| privilegeWithdrawn | 9 | Indicates that there has been a subscriber-side infraction that has not resulted in keyCompromise, such as the Certificate Subscriber provided misleading information in their Certificate Request or has not upheld their material obligations under the Subscriber Agreement or Terms of Use. | +| __RFC 5280 reasonCode__ | __RFC 5280 reasonCode value__ | +| --- | - | +| unspecified | 0 | +| keyCompromise | 1 | +| affiliationChanged | 3 | +| superseded | 4 | +| cessationOfOperation | 5 | +| privilegeWithdrawn | 9 | The Subscriber Agreement, or an online resource referenced therein, MUST inform Subscribers about the revocation reason options listed above and provide explanation about when to choose each option. Tools that the CA provides to the Subscriber MUST allow for these options to be easily specified when the Subscriber requests revocation of their Certificate, with the default value being that no revocation reason is provided (i.e. the default corresponds to the CRLReason "unspecified (0)" which results in no reasonCode extension being provided in the CRL). From 4d39f5e5e60ab2cd8b4757ab871f0c006a5e6366 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 14:37:17 -0400 Subject: [PATCH 02/10] Update BR.md --- docs/BR.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/BR.md b/docs/BR.md index c398b00c..43576fe7 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -3609,6 +3609,8 @@ The Subscriber Agreement, or an online resource referenced therein, MUST inform The privilegeWithdrawn reasonCode SHOULD NOT be made available to the Subscriber as a revocation reason option, because the use of this reasonCode is determined by the CA and not the Subscriber. +In cases where multiple reasonCodes are considered appropriate for a revocation, keyCompromise and affiliationChange reasons MUST take precedence, and in that order. + When a CA obtains verifiable evidence of Key Compromise for a Certificate whose CRL entry does not contain a reasonCode extension or has a reasonCode extension with a non-keyCompromise reason, the CA SHOULD update the CRL entry to enter keyCompromise as the CRLReason in the reasonCode extension. #### 7.2.2.1 CRL Issuing Distribution Point From 8d26f515397798a1b7eec6b0f9318bbea18e0c54 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 14:39:05 -0400 Subject: [PATCH 03/10] Update BR.md --- docs/BR.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 43576fe7..e7d23dc6 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1493,12 +1493,12 @@ The CA MAY support revocation of Short-lived Subscriber Certificates. With the exception of Short-lived Subscriber Certificates, the CA SHALL revoke a Certificate within 24 hours and use the corresponding CRLReason (see Section 7.2.2) if one or more of the following occurs: 1. The CA obtains evidence that the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise OR the CA is made aware of a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. (CRLReason #1, keyCompromise) -2. The CA obtains evidence that the validation of domain authorization, control for any Fully-Qualified Domain Name or IP address in the Certificate, or CA Authorization Record relied upon during issuance should not be relied upon. (CRLReason #3, affiliationChanged) +2. The CA obtains evidence that the validation of domain authorization, control for any Fully-Qualified Domain Name or IP address in the Certificate, or CA Authorization Record relied upon during issuance should not be relied upon. CRLReason #9, privilegeWithdrawn) With the exception of Short-lived Subscriber Certificates, the CA SHOULD revoke a certificate within 24 hours and MUST revoke a Certificate within 5 days and use the corresponding CRLReason (see Section 7.2.2) if one or more of the following occurs: 3. The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA's Certificate Policy or Certification Practice Statement. (CRLReason #5, cessationOfOperation) -4. The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. (CRLReason #9, privilegeWithdrawn) +4. The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. (CRLReason #3, affiliationChanged) 5. The Subscriber requests in writing, without specifying a CRLreason, that the CA revoke the Certificate, or for any other purpose. (CRLReason #0, unspecified) #### 4.9.1.2 Reasons for Revoking a Subordinate CA Certificate From 21595437f9d995aabcfc1cd0d34bb23fce90a683 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 15:07:18 -0400 Subject: [PATCH 04/10] Update BR.md --- docs/BR.md | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index e7d23dc6..edde2eed 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1490,16 +1490,15 @@ No stipulation. The CA MAY support revocation of Short-lived Subscriber Certificates. -With the exception of Short-lived Subscriber Certificates, the CA SHALL revoke a Certificate within 24 hours and use the corresponding CRLReason (see Section 7.2.2) if one or more of the following occurs: - -1. The CA obtains evidence that the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise OR the CA is made aware of a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. (CRLReason #1, keyCompromise) -2. The CA obtains evidence that the validation of domain authorization, control for any Fully-Qualified Domain Name or IP address in the Certificate, or CA Authorization Record relied upon during issuance should not be relied upon. CRLReason #9, privilegeWithdrawn) - -With the exception of Short-lived Subscriber Certificates, the CA SHOULD revoke a certificate within 24 hours and MUST revoke a Certificate within 5 days and use the corresponding CRLReason (see Section 7.2.2) if one or more of the following occurs: - -3. The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA's Certificate Policy or Certification Practice Statement. (CRLReason #5, cessationOfOperation) -4. The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. (CRLReason #3, affiliationChanged) -5. The Subscriber requests in writing, without specifying a CRLreason, that the CA revoke the Certificate, or for any other purpose. (CRLReason #0, unspecified) +With the exception of Short-lived Subscriber Certificates, the CA MUST revoke a Certificate in accordance with the following: + +| **Revocation ID** | **Description of Revocation Event** | **Revocation Timeline** | **RFC 5280 `reasonCode`** | +| :---: | --- | --- | :---: | +| 1 | The CA obtains evidence (A) that the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise OR (B) of a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. | MUST within 24 hours | `keyCompromise` (1) | +| 2 | The CA obtains evidence that the validation of domain authorization, control for any Fully-Qualified Domain Name or IP address in the Certificate, or CA Authorization Record relied upon during issuance should not be relied upon. | MUST within 24 hours | `privilegeWithdrawn` (9) | +| 3 | The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA's Certificate Policy or Certification Practice Statement.. | SHOULD within 24 hours, but MUST within 5 days | `cessationOfOperation` (5) | +| 4 | The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. | SHOULD within 24 hours, but MUST within 5 days | `affiliationChanged` (3) | +| 5 | Either: (A) The Subscriber requests revocation in writing, without specifying a CRLreason, and the circumstances for the request do not meet the immediately above criteria OR (B) for any other reason, and the circumstances for the request do not meet the immediately above criteria. | SHOULD within 24 hours, but MUST within 5 days | `unspecified` (0) | #### 4.9.1.2 Reasons for Revoking a Subordinate CA Certificate @@ -3534,7 +3533,7 @@ The following Certificate Policy identifiers are reserved for use by CAs as an o ## 7.2 CRL profile -Prior to 2024‐03‐15, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements or the profile specified in Version 1.8.7 of the Baseline Requirements for the Issuance and Management of Publicly‐Trusted Certificates. Effective 2024‐03‐15, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements. +Prior to 20XX-XX-XX, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements or the profile specified in version 2.0.X of the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates. Effective 20XX-XX-XX, the CA SHALL issue Certificates in accordance with the profile specified in these Requirements. If the CA asserts compliance with these Baseline Requirements, all CRLs that it issues MUST comply with the following CRL profile, which incorporates, and is derived from [RFC 5280](https://tools.ietf.org/html/rfc5280). Except as explicitly noted, all normative requirements imposed by RFC 5280 shall apply, in addition to the normative requirements imposed by this document. CAs SHOULD examine [RFC 5280, Appendix B](https://tools.ietf.org/html/rfc5280#appendix-B) for further issues to be aware of. @@ -3594,7 +3593,7 @@ Table: crlEntryExtensions Component | `reasonCode` | * | When present (OID 2.5.29.21), MUST NOT be marked critical and MUST indicate the most appropriate reason for revocation of the Certificate.

MUST be present unless the reason for revocation (i.e., reasonCode) is unspecified (0).

See Section 4.9.1 for additional requirements. | | Any other value | NOT RECOMMENDED | - | -Table: CRLReasons +Table: Permitted reasonCode Values | __RFC 5280 reasonCode__ | __RFC 5280 reasonCode value__ | | --- | - | @@ -3605,14 +3604,14 @@ Table: CRLReasons | cessationOfOperation | 5 | | privilegeWithdrawn | 9 | -The Subscriber Agreement, or an online resource referenced therein, MUST inform Subscribers about the revocation reason options listed above and provide explanation about when to choose each option. Tools that the CA provides to the Subscriber MUST allow for these options to be easily specified when the Subscriber requests revocation of their Certificate, with the default value being that no revocation reason is provided (i.e. the default corresponds to the CRLReason "unspecified (0)" which results in no reasonCode extension being provided in the CRL). - -The privilegeWithdrawn reasonCode SHOULD NOT be made available to the Subscriber as a revocation reason option, because the use of this reasonCode is determined by the CA and not the Subscriber. - In cases where multiple reasonCodes are considered appropriate for a revocation, keyCompromise and affiliationChange reasons MUST take precedence, and in that order. When a CA obtains verifiable evidence of Key Compromise for a Certificate whose CRL entry does not contain a reasonCode extension or has a reasonCode extension with a non-keyCompromise reason, the CA SHOULD update the CRL entry to enter keyCompromise as the CRLReason in the reasonCode extension. +The Subscriber Agreement, or an online resource referenced therein, MUST inform Subscribers about the revocation reason options listed above and provide explanation about when to choose each option. Tools that the CA provides to the Subscriber MUST allow for these options to be easily specified when the Subscriber requests revocation of their Certificate, with the default value being that no revocation reason is provided (i.e. the default corresponds to the CRLReason "unspecified (0)" which results in no reasonCode extension being provided in the CRL). + +The privilegeWithdrawn reasonCode SHOULD NOT be made available to the Subscriber as a revocation reason option, because the use of this reasonCode is determined by the CA and not the Subscriber. + #### 7.2.2.1 CRL Issuing Distribution Point Partitioned CRLs MUST contain an Issuing Distribution Point extension. The `distributionPoint` field of the Issuing Distribution Point extension MUST be present. Additionally, the `fullName` field of the DistributionPointName value MUST be present, and its value MUST conform to the following requirements: From c216864ff5c529fd0751cbc620b9c5d637652b06 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 15:17:33 -0400 Subject: [PATCH 05/10] Update BR.md --- docs/BR.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index edde2eed..6474f525 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -3533,7 +3533,7 @@ The following Certificate Policy identifiers are reserved for use by CAs as an o ## 7.2 CRL profile -Prior to 20XX-XX-XX, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements or the profile specified in version 2.0.X of the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates. Effective 20XX-XX-XX, the CA SHALL issue Certificates in accordance with the profile specified in these Requirements. +Prior to 2024‐03‐15, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements or the profile specified in Version 1.8.7 of the Baseline Requirements for the Issuance and Management of Publicly‐Trusted Certificates. Effective 2024‐03‐15, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements. If the CA asserts compliance with these Baseline Requirements, all CRLs that it issues MUST comply with the following CRL profile, which incorporates, and is derived from [RFC 5280](https://tools.ietf.org/html/rfc5280). Except as explicitly noted, all normative requirements imposed by RFC 5280 shall apply, in addition to the normative requirements imposed by this document. CAs SHOULD examine [RFC 5280, Appendix B](https://tools.ietf.org/html/rfc5280#appendix-B) for further issues to be aware of. @@ -3593,6 +3593,7 @@ Table: crlEntryExtensions Component | `reasonCode` | * | When present (OID 2.5.29.21), MUST NOT be marked critical and MUST indicate the most appropriate reason for revocation of the Certificate.

MUST be present unless the reason for revocation (i.e., reasonCode) is unspecified (0).

See Section 4.9.1 for additional requirements. | | Any other value | NOT RECOMMENDED | - | +For any certificate revoked on or after 20XX-XX-XX, the reasonCode extension, if present, MUST contain one of the values specified below. The extension MUST be included for all permitted reasons except for unspecified (0). Table: Permitted reasonCode Values | __RFC 5280 reasonCode__ | __RFC 5280 reasonCode value__ | @@ -3600,7 +3601,6 @@ Table: Permitted reasonCode Values | unspecified | 0 | | keyCompromise | 1 | | affiliationChanged | 3 | -| superseded | 4 | | cessationOfOperation | 5 | | privilegeWithdrawn | 9 | From 4b3d7f6326742bb61f675ec8db0361facde686ea Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 15:37:17 -0400 Subject: [PATCH 06/10] Update BR.md --- docs/BR.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 6474f525..84d085a6 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1494,11 +1494,11 @@ With the exception of Short-lived Subscriber Certificates, the CA MUST revoke a | **Revocation ID** | **Description of Revocation Event** | **Revocation Timeline** | **RFC 5280 `reasonCode`** | | :---: | --- | --- | :---: | -| 1 | The CA obtains evidence (A) that the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise OR (B) of a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. | MUST within 24 hours | `keyCompromise` (1) | -| 2 | The CA obtains evidence that the validation of domain authorization, control for any Fully-Qualified Domain Name or IP address in the Certificate, or CA Authorization Record relied upon during issuance should not be relied upon. | MUST within 24 hours | `privilegeWithdrawn` (9) | -| 3 | The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA's Certificate Policy or Certification Practice Statement.. | SHOULD within 24 hours, but MUST within 5 days | `cessationOfOperation` (5) | +| 1 | The CA obtains evidence of either:

(A) the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise

OR

(B) a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. | MUST within 24 hours | `keyCompromise` (1) | +| 2 | The CA obtains evidence that either of the following should not be relied upon:

(A) the validation of domain authorization or control for any fully‐qualified domain name or IP address in the Certificate

OR

(B) the CA's authority to issue a Certificate for the requested domain(s) or IP address(es) in the Certificate. | MUST within 24 hours | `privilegeWithdrawn` (9) | +| 3 | The CA is made aware that the Certificate was not issued in accordance with either:

(A) these Requirements

OR

(B) the CA's Certificate Policy or Certification Practice Statement. | SHOULD within 24 hours, but MUST within 5 days | `cessationOfOperation` (5) | | 4 | The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. | SHOULD within 24 hours, but MUST within 5 days | `affiliationChanged` (3) | -| 5 | Either: (A) The Subscriber requests revocation in writing, without specifying a CRLreason, and the circumstances for the request do not meet the immediately above criteria OR (B) for any other reason, and the circumstances for the request do not meet the immediately above criteria. | SHOULD within 24 hours, but MUST within 5 days | `unspecified` (0) | +| 5 | Either:

(A) The Subscriber requests revocation in writing, without specifying a CRLreason, and the circumstances for the request do not meet the immediately above criteria

OR

(B) for any other reason, and the circumstances for the request do not meet the immediately above criteria. | SHOULD within 24 hours, but MUST within 5 days | `unspecified` (0) | #### 4.9.1.2 Reasons for Revoking a Subordinate CA Certificate From c43e03c19eedd14dcc5b50fa495b5b25c48f0091 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 15:47:59 -0400 Subject: [PATCH 07/10] Update BR.md --- docs/BR.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 84d085a6..d5bf4f6d 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1492,13 +1492,13 @@ The CA MAY support revocation of Short-lived Subscriber Certificates. With the exception of Short-lived Subscriber Certificates, the CA MUST revoke a Certificate in accordance with the following: -| **Revocation ID** | **Description of Revocation Event** | **Revocation Timeline** | **RFC 5280 `reasonCode`** | -| :---: | --- | --- | :---: | -| 1 | The CA obtains evidence of either:

(A) the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise

OR

(B) a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. | MUST within 24 hours | `keyCompromise` (1) | -| 2 | The CA obtains evidence that either of the following should not be relied upon:

(A) the validation of domain authorization or control for any fully‐qualified domain name or IP address in the Certificate

OR

(B) the CA's authority to issue a Certificate for the requested domain(s) or IP address(es) in the Certificate. | MUST within 24 hours | `privilegeWithdrawn` (9) | -| 3 | The CA is made aware that the Certificate was not issued in accordance with either:

(A) these Requirements

OR

(B) the CA's Certificate Policy or Certification Practice Statement. | SHOULD within 24 hours, but MUST within 5 days | `cessationOfOperation` (5) | -| 4 | The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. | SHOULD within 24 hours, but MUST within 5 days | `affiliationChanged` (3) | -| 5 | Either:

(A) The Subscriber requests revocation in writing, without specifying a CRLreason, and the circumstances for the request do not meet the immediately above criteria

OR

(B) for any other reason, and the circumstances for the request do not meet the immediately above criteria. | SHOULD within 24 hours, but MUST within 5 days | `unspecified` (0) | +**Description of Revocation Event** | **Revocation Timeline** | **RFC 5280 `reasonCode`** | +| :---: | --- | :---: | +| The CA obtains evidence of either:

(A) the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise

OR

(B) a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. | MUST within 24 hours | `keyCompromise` (1) | +| The CA obtains evidence that either of the following should not be relied upon:

(A) the validation of domain authorization or control for any fully‐qualified domain name or IP address in the Certificate

OR

(B) the CA's authority to issue a Certificate for the requested domain(s) or IP address(es) in the Certificate. | MUST within 24 hours | `privilegeWithdrawn` (9) | +| The CA is made aware that the Certificate was not issued in accordance with either:

(A) these Requirements

OR

(B) the CA's Certificate Policy or Certification Practice Statement. | SHOULD within 24 hours, but MUST within 5 days | `cessationOfOperation` (5) | +| The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. | SHOULD within 24 hours, but MUST within 5 days | `affiliationChanged` (3) | +| Either:

(A) The Subscriber requests revocation in writing, without specifying a CRLreason, and the circumstances for the request do not meet the immediately above criteria

OR

(B) for any other reason, and the circumstances for the request do not meet the immediately above criteria. | SHOULD within 24 hours, but MUST within 5 days | `unspecified` (0) | #### 4.9.1.2 Reasons for Revoking a Subordinate CA Certificate From 704729f7454ea58a80147560639b0f9cf5bf16f0 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 15:51:37 -0400 Subject: [PATCH 08/10] Update BR.md --- docs/BR.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index d5bf4f6d..484c934b 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1492,13 +1492,13 @@ The CA MAY support revocation of Short-lived Subscriber Certificates. With the exception of Short-lived Subscriber Certificates, the CA MUST revoke a Certificate in accordance with the following: -**Description of Revocation Event** | **Revocation Timeline** | **RFC 5280 `reasonCode`** | -| :---: | --- | :---: | -| The CA obtains evidence of either:

(A) the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise

OR

(B) a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. | MUST within 24 hours | `keyCompromise` (1) | -| The CA obtains evidence that either of the following should not be relied upon:

(A) the validation of domain authorization or control for any fully‐qualified domain name or IP address in the Certificate

OR

(B) the CA's authority to issue a Certificate for the requested domain(s) or IP address(es) in the Certificate. | MUST within 24 hours | `privilegeWithdrawn` (9) | -| The CA is made aware that the Certificate was not issued in accordance with either:

(A) these Requirements

OR

(B) the CA's Certificate Policy or Certification Practice Statement. | SHOULD within 24 hours, but MUST within 5 days | `cessationOfOperation` (5) | -| The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. | SHOULD within 24 hours, but MUST within 5 days | `affiliationChanged` (3) | -| Either:

(A) The Subscriber requests revocation in writing, without specifying a CRLreason, and the circumstances for the request do not meet the immediately above criteria

OR

(B) for any other reason, and the circumstances for the request do not meet the immediately above criteria. | SHOULD within 24 hours, but MUST within 5 days | `unspecified` (0) | +| **#** | **Description of Revocation Event** | **Revocation Timeline** | **RFC 5280 `reasonCode`** | +| :---: | --- | --- | :---: | +| 1 | The CA obtains evidence of either:

(A) the Subscriber's Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise

OR

(B) a demonstrated or proven method that can easily compute the Subscriber's Private Key based on the Public Key in the Certificate. | MUST within 24 hours | `keyCompromise` (1) | +| 2 | The CA obtains evidence that either of the following should not be relied upon:

(A) the validation of domain authorization or control for any fully‐qualified domain name or IP address in the Certificate

OR

(B) the CA's authority to issue a Certificate for the requested domain(s) or IP address(es) in the Certificate. | MUST within 24 hours | `privilegeWithdrawn` (9) | +| 3 | The CA is made aware that the Certificate was not issued in accordance with either:

(A) these Requirements

OR

(B) the CA's Certificate Policy or Certification Practice Statement. | SHOULD within 24 hours, but MUST within 5 days | `cessationOfOperation` (5) | +| 4 | The CA is made aware that the Subscriber's request, issuance, or use of a resulting Certificate has violated one or more of its material obligations under the Subscriber Agreement or Terms of Use. | SHOULD within 24 hours, but MUST within 5 days | `affiliationChanged` (3) | +| 5 | Either:

(A) The Subscriber requests revocation in writing, without specifying a CRLreason, and the circumstances for the request do not meet the immediately above criteria

OR

(B) for any other reason, and the circumstances for the request do not meet the immediately above criteria. | SHOULD within 24 hours, but MUST within 5 days | `unspecified` (0) | #### 4.9.1.2 Reasons for Revoking a Subordinate CA Certificate From 7716f793c4ccde51c7a5c82cd074fd9ec90bd167 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 16:01:15 -0400 Subject: [PATCH 09/10] Update BR.md --- docs/BR.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/BR.md b/docs/BR.md index 484c934b..ff081eb4 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -3594,6 +3594,7 @@ Table: crlEntryExtensions Component | Any other value | NOT RECOMMENDED | - | For any certificate revoked on or after 20XX-XX-XX, the reasonCode extension, if present, MUST contain one of the values specified below. The extension MUST be included for all permitted reasons except for unspecified (0). + Table: Permitted reasonCode Values | __RFC 5280 reasonCode__ | __RFC 5280 reasonCode value__ | From ffaaeb6989e1775ce84762abaf948d88aca380d4 Mon Sep 17 00:00:00 2001 From: Ryan Dickson Date: Mon, 29 Sep 2025 16:38:03 -0400 Subject: [PATCH 10/10] Update BR.md --- docs/BR.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index ff081eb4..b05972d5 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -3605,14 +3605,12 @@ Table: Permitted reasonCode Values | cessationOfOperation | 5 | | privilegeWithdrawn | 9 | -In cases where multiple reasonCodes are considered appropriate for a revocation, keyCompromise and affiliationChange reasons MUST take precedence, and in that order. +In cases where multiple reasonCodes are considered appropriate for a revocation, keyCompromise and privilegeWithdrawn reasons MUST take precedence, and in that order. When a CA obtains verifiable evidence of Key Compromise for a Certificate whose CRL entry does not contain a reasonCode extension or has a reasonCode extension with a non-keyCompromise reason, the CA SHOULD update the CRL entry to enter keyCompromise as the CRLReason in the reasonCode extension. The Subscriber Agreement, or an online resource referenced therein, MUST inform Subscribers about the revocation reason options listed above and provide explanation about when to choose each option. Tools that the CA provides to the Subscriber MUST allow for these options to be easily specified when the Subscriber requests revocation of their Certificate, with the default value being that no revocation reason is provided (i.e. the default corresponds to the CRLReason "unspecified (0)" which results in no reasonCode extension being provided in the CRL). -The privilegeWithdrawn reasonCode SHOULD NOT be made available to the Subscriber as a revocation reason option, because the use of this reasonCode is determined by the CA and not the Subscriber. - #### 7.2.2.1 CRL Issuing Distribution Point Partitioned CRLs MUST contain an Issuing Distribution Point extension. The `distributionPoint` field of the Issuing Distribution Point extension MUST be present. Additionally, the `fullName` field of the DistributionPointName value MUST be present, and its value MUST conform to the following requirements: