Pular para o conteúdo principal

Policies with a grace period

In validation there is an unavoidable delay between a certificate's revocation request and the distribution of the matching revocation report. For more reliable signature validation, a grace period is recommended.

Grace period​

The grace period is the time expected for a certificate's revocation information to propagate through the Certification Authority's internal process until it is published by the trusted parties.

From the validator's point of view, it is the shortest time it must wait before requesting a certificate's revocation status, so that the responsible issuer has published it reliably.

When validating a signature with a trusted date, a mechanism that keeps the signature valid even after the signer's certificate is revoked or expires, the validator must, before asserting the validity of this certificate, make sure the grace period lies between the signature's date reference and the date of the revocation data used. This date reference can be a signature timestamp (TST) or a time-mark from a trusted authority.

The length of the grace period, and whether the revocation values used must have been issued after it ends, are the responsibility of the Certification Authority and must be stated in its Certification Practice Statement (CPS).

Grace period

Signing with a grace period​

Signatures whose policy has a grace period can only be created with the asynchronous signature finishing strategy. For more information, see Asynchronous signature finishing.

To include a fixed grace period in the policy, use the @Lacuna.Pki.Cades.CadesPolicySpec.SetGracePeriod(System.TimeSpan) method, as in the example below.

// Loading a signature policy
CadesPolicySpec policy = ...

// Setting a fixed grace period of 2 hours
policy.SetGracePeriod(TimeSpan.FromHours(2));

You can also use an @Lacuna.Pki.IGracePeriodCatalog, a grace period catalog that returns the length of the grace period based on information of the signer's certificate, such as the Issuer or CertificatePolicies, and set it on the policy through the @Lacuna.Pki.Cades.CadesPolicySpec.GracePeriodCatalog property.

// Implementation of a grace period catalog
IGracePeriodCatalog catalog = ...

policy.GracePeriodCatalog = catalog;

See also​

View as Markdown