憑證廢止清冊之簽發頻率

CRL issuance frequency

CRLs MUST be available via a publicly-accessible HTTP URL (i.e., “published”).

憑證廢止清冊（Certificate Revocation List，CRL）應（MUST）可透過能公開存取之 HTTP URL 取得（即視為「已發布（published）」）。

Within twenty-four (24) hours of issuing its first Certificate, the CA MUST generate and publish either:

憑證機構（Certification Authority，CA）應（MUST）於簽發其第一張憑證後 24 小時內，產生並發布下列任一項：

• a full and complete CRL; OR

• 完整 CRL（full and complete CRL）；或

• partitioned (i.e., “sharded”) CRLs that, when aggregated, represent the equivalent of a full and complete CRL.

• 分割式（即「分片（sharded）」）CRL，其全部分片彙整後應相當於一份完整 CRL。

CAs issuing Subscriber Certificates:

簽發用戶憑證（Subscriber Certificates）之憑證機構：

1. MUST update and publish a new CRL at least every:
   • seven (7) days if all Certificates include an Authority Information Access extension with an id-ad-ocsp accessMethod (“AIA OCSP pointer”); or
   • four (4) days in all other cases;

1. 應（MUST）至少每隔下列期間更新並發布新的憑證廢止清冊（CRL）：
   • 若所有憑證均包含其 accessMethod 為 id-ad-ocsp 之憑證機構資訊存取（Authority Information Access，AIA）擴充欄位（「AIA OCSP 指示資訊」），則為 7 日；或
   • 其他所有情況下為 4 日；

2. MUST update and publish a new CRL within twenty-four (24) hours after recording a Certificate as revoked.

2. 應（MUST）於憑證記為已廢止後 24 小時內更新並發布新的 CRL。

CAs issuing CA Certificates:

簽發 CA 憑證之憑證機構：

1. MUST update and publish a new CRL at least every twelve (12) months;

1. 應（MUST）至少每 12 個月更新並發布新的 CRL；

2. MUST update and publish a new CRL within twenty-four (24) hours after recording a Certificate as revoked.

2. 應（MUST）於憑證記為已廢止後 24 小時內更新並發布新的 CRL。

CAs MUST continue issuing CRLs until one of the following is true:

憑證機構應（MUST）持續發布 CRL，直到下列任一情況成立：

• all Subordinate CA Certificates containing the same Subject Public Key are expired or revoked; OR

• 所有包含相同主體公開金鑰（Subject Public Key）之下屬憑證機構（Subordinate CA）憑證均已到期或遭廢止；或

• the corresponding Subordinate CA Private Key is destroyed.

• 對應之下屬憑證機構私密金鑰已銷毀。