BTW what is the need for a CA to remember issued certificates?
Certificates should work as long as they are not expired, not on a CRL, and while the same applies to their.CA's certificate used to sign it.
The only good use for remembering issued certificates that I see is that a CA could detect a compromise if it's handed a certificate it does not remember issuing. It looks far-fetched to me, but I know nothing about CA operation.
Certificates should work as long as they are not expired, not on a CRL, and while the same applies to their.CA's certificate used to sign it.
The only good use for remembering issued certificates that I see is that a CA could detect a compromise if it's handed a certificate it does not remember issuing. It looks far-fetched to me, but I know nothing about CA operation.