I'm working on software that will be in use for foreseeable future (15 years+) that will need to validate XAdES-A signatures (long term archival, similar to PAdES-A, but for XML). That means, it will have multiple CA certificates required for its verification, different signature algorithms and different digest algorithms.
As such, I see two problems:
- getting information which CA certificates lost their validity before their
notValidAfterdate (because of CA compromise, cease of operation, etc.)
- marking algorithms (like SHA-1) or key lengths (like RSA 1024) as insecure after some date
Is there some standard for files with such information? If I create my own, should I rather choose to save this information as OIDs (algorithms) or just as human-readable names (I'm using Java if that has anything to do with this...).