Certificate Revocation and Renewal

Abstract

Like credit cards, digital certificates have a limited validity period. Most credit cards have only an expiration date (end of validity period), while digital certificates also have a start of validity period. The CA determines the start and end of the validity period when they issue a digital certificate, and those are included in the X.509 structure. These are covered by the certificate digital signature so they cannot be changed without detection. An expired digital certificate should normally not be used, except in certain specific situations (such as reading an old encrypted email). It is up to every relying application to check the validity dates against a trusted time source every time a certificate is used. As with credit cards, sometime you need to “expire” a certificate before the official expiration date. This is accomplished via “certificate revocation checking”. Any expired or revoked certificate can normally be renewed with a later validity period.