3 ms·

A certificate revocation request signed by the private key is proof of private key compromise. Anyone issuing such a revocation due to knowledge of compromise

A certificate revocation request signed by the private key is proof of private key compromise. Anyone issuing such a revocation due to knowledge of compromise of the key is notifying the issuing authority of the compromise. If a key is used for a purpose not listed as allowed in the certificate, it's compromised, even if the entity that misused the key is the original holder. Anyone issuing such a revocation without authorization has the private key, and is using it for something they're not authorized to use it for. It's compromised by definition. There's never a reason not to revoke a certificate when a valid revocation request is received. The key has been compromised, either by leaking or by misuse.

_qulr 6y ago
> A certificate revocation request signed by the private key is proof of private key compromise. There's no such thing in this case. In the blog post, I quoted from Apple's Certification Practice Statement: "The Subscriber may initiate a revocation request by sending an email to productsecurity@apple.com. The request for revocation will then be evaluated by Apple." Everyone wants to make an analogy between Developer ID code signing certificates and web server certificates, but the usage of the two kinds of certs is completely different.