No Revocation Available for X.509 Public Key Certificates
RFC 9608, “No Revocation Available for X.509 Public Key Certificates”, is a Proposed Standard document published in June 2024 by R. Housley, T. Okubo, J. Mandel. It updates RFC 5280. The canonical text is published by the RFC Editor.
Abstract
X.509v3 public key certificates are profiled in RFC 5280. Short-lived certificates are seeing greater use in the Internet. The Certification Authority (CA) that issues these short-lived certificates do not publish revocation information because the certificate lifespan that is shorter than the time needed to detect, report, and distribute revocation information. Some long-lived X.509v3 public key certificates never expire, and they are never revoked. This specification defines the noRevAvail certificate extension so that a relying party can readily determine that the CA does not publish revocation information for the certificate, and it updates the certification path validation algorithm defined in RFC 5280 so that revocation checking is skipped when the noRevAvail certificate extension is present.
What “Proposed Standard” means
An entry-level standards-track specification: stable, peer-reviewed and a solid basis for implementation, though it may still evolve before becoming an Internet Standard.
The canonical text of RFC 9608 is hosted at rfc-editor.org. Available in HTML,TXT,PDF,XML.
- RFC 9607 RTP Payload Format for the Secure Communication Interoperability Protocol Codec
- RFC 9606 DNS Resolver Information
- RFC 9610 JSON Meta Application Protocol for Contacts
- RFC 9605 Secure Frame : Lightweight Authenticated Encryption for Real-Time Media
- RFC 9611 Internet Key Exchange Protocol Version 2 Support for Per- Resource Child Security Associations
- RFC 9604 Carrying Binding Label/SID in PCE-Based Networks
- RFC 9612 Bidirectional Forwarding Detection Reverse Path for MPLS Label Switched Paths
- RFC 9603 Path Computation Element Communication Protocol Extensions for IPv6 Segment Routing