Subject: [pkix] Same notAfter date for CA and EE certificate

From: "Jim Schaad" <[email-masked]>
Date: Mon, 28 Feb 2011 15:39:19 -0800

When reading the thread on how to issue the last CRL, the following text
popped into my head

An entry is added to the CRL as part of the next update
   following notification of revocation.  An entry MUST NOT be removed
   from the CRL until it appears on one regularly scheduled CRL issued
   beyond the revoked certificate's validity period.

The problem is that the MUST NOT cannot be followed if the EE and the CA
have the same expiration date.  Any CRL issued after the expiration date of
the revoked EE certificate would be after the validity period of the CA
certificate and thus not acceptable.

This is a potential issue for certificates that are issued at the last
second, and is more of an issue for historical checking of revocations.
I.e. you cannot do a query for a CRL that was issued delta time after a
signature operation.

Yet one more reason to recommend that a CA stop issuing certificates well
before its own expiration I guess.  Does anybody feel that the text should
be updated since the MUST NOT cannot possibly be satisfied.

Jim