2 removed thank you
source | link

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA certificate, the only case where I see that would be applicable is if a browser for example doesn't add the new CA certificate in its trust store for a period of time and so it can't verify the new CRLs, is that the case  ?

Thank you!

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA certificate, the only case where I see that would be applicable is if a browser for example doesn't add the new CA certificate in its trust store for a period of time and so it can't verify the new CRLs, is that the case  ?

Thank you!

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA certificate, the only case where I see that would be applicable is if a browser for example doesn't add the new CA certificate in its trust store for a period of time and so it can't verify the new CRLs, is that the case?

1
source | link

What's the goal behind signing a CRL with an old certificate key?

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA certificate, the only case where I see that would be applicable is if a browser for example doesn't add the new CA certificate in its trust store for a period of time and so it can't verify the new CRLs, is that the case ?

Thank you!