4 ms·

> ... how closely do CAs look at requests to revoke certificates? If they want to remain a CA, very closely! -- Per the (Server Certificate) Baseline Require

> ... how closely do CAs look at requests to revoke certificates? If they want to remain a CA, very closely! -- Per the (Server Certificate) Baseline Requirements [0]: > 4.9.1.1 Reasons for Revoking a Subscriber Certificate > The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs: > 1. The Subscriber requests in writing that the CA revoke the Certificate; > ... The Code Signing BR's [1] have almost the same requirement. For code signing certificates, the CA "MUST*" revoke the certificate upon request "within one business day" (cf. 13.1.5, IIRC). I'm not sure if this particular certificate falls under those BR's or not, though (see my other comment). My guess would be that it does not. -- [0]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... (PDF) [1]: https://cabforum.org/wp-content/uploads/baseline_requirements_for_the_issuance_and_management_of_code_signing.v.2.0.pdf https://cabforum.org/wp-content/uploads/baseline_requirement... (PDF)

aw1621107 6y ago
Thanks for explaining! Curious what the intent is behind Apple saying they'll evaluate the request. I do realize that this request falls under different guidelines, but I wonder whether it's merely a difference in wording rather than practice.
olliej 6y ago
It is not closely examined. The "examination" for revocation is very simple for every CA - does the request include demonstrated control of the private key. If it does, honor the revocation request. They have at most one business day to revoke. For evidence of actual compromise (e.g. not a first party revocation request) they have 24 hours. Note that the the CARB rules don't allow the CA to delay revocation for compromised certs, even if the true owner asks for it.

aw1621107 6y ago

Thanks for explaining! Curious what the intent is behind Apple saying they'll evaluate the request. I do realize that this request falls under different guidelines, but I wonder whether it's merely a difference in wording rather than practice.

olliej 6y ago

It is not closely examined. The "examination" for revocation is very simple for every CA - does the request include demonstrated control of the private key. If it does, honor the revocation request. They have at most one business day to revoke. For evidence of actual compromise (e.g. not a first party revocation request) they have 24 hours. Note that the the CARB rules don't allow the CA to delay revocation for compromised certs, even if the true owner asks for it.