Certificate management tools use options called revocation and retiring digital certificates.Can someone explain what is the difference between both?
2
-
just a guess: Revocation = revoke the certificate so it no longer works. Retiring = remove the certificate from the store, i.e. delete it from the server.– user15194Commented Apr 8, 2016 at 9:18
-
I have never encountered the term "retire" in the context of certificates. Can you edit your question to provide a link to the software in question as maybe it has a specific meaning within the context of that software? If not, can you provide an explanation of what the "retire" button does?– Mike OunsworthCommented Apr 8, 2016 at 14:32
Add a comment
|
2 Answers
I would think this might have to do with what flag is used to mark the cert when it is added to the revocation list. A cert added with reason 4(superseded) or reason 5(cessationOfOperation) are not being revoked because of some compromise or inherent flaw so could be considered to be "retired".
There have been several types of certs(sha1 and MD5) that are signed with insecure hashes that are being phased out or "retired" as well.
I have never heard the term "retire" applied to certificates. Maybe it has a specific meaning within the context of your certificate management tool?
A "revoked" certificate should be considered compromised and no longer trusted. My guess is that a "retired" certificate is no longer being managed by the CA, but there's no evidence of compromise, so the client can decide whether to trust it or not. I guess it's a way of putting it into the same category as an "expired" cert before the marked expiry date.
Whatever they're doing, it's probably not industry standard, and probably only works with their clients.
answered Apr 8, 2016 at 14:42
-
@MikeI could see the "retire" option in Venafi certificate management system.– PravinCommented Apr 11, 2016 at 10:40