-4

Background
The original question: How is revocation of a root certificate handled?
My rejected edit

Reasons for editing

If a CA certificate is revoked then it cannot be used

This is not entirely correct as the CA is simply no longer trusted. Intermediate CA which it had approved before revocation date should still be trusted, which can be proved from the timestamp, if available.

The certificates which that CA issued are not revoked: possibly, they may be verifiable with another CA certificate which contains the same key: a CA certificate is like any other certificate, it binds a name with a public key; nothing prevents the existence of several distinct certificates which assert that binding

This is the confusing part. The OP of this answer actually meant a Root CA may delegate trust to an intermediate CA by binding the inter-CA name with the inter-CA's public key.
The OP of the question then asked the followings as the first comment to this answer:

I did not know there was a case where we could have the same public key with multiple certificates.In this case, the public key is the same but I assume the subject dn is different?

This implies the answer was misinterpreted, as the question-OP thought there were multiple entities with the same public key (as in different Subject Distinguished Name).

With these in mind, you will understand my grievance over the rejection on my edit and also the reason for rejecting it.

*I have in fact adhered to the original intent of the answer. My edit shall be broken down to: adding supplementary info (for the timestamp) and rephrasing the answer to clear confusion (on the "same public key").

9
  • 6
    Why are you trying to "correct" information in a post with edits? That's not the job of an edit. Instead downvotes and comments are better tools. "Probably meant" is not a very compelling to edit something.
    – ryanyuyu
    Commented Mar 20, 2015 at 16:22
  • @ryanyuyu I am editing the answer, not the question. "Probably meant" is now "Actually meant", as my threshold of "probably" is much higher than average.
    – guest
    Commented Mar 20, 2015 at 16:43
  • I don't think "actually meant" is the right term here. I think what he actually meant was what he wrote: a certificate binds a name to a public key. It doesn't bind the name to the public key. You shouldn't have two different entities with the same key, but there's no technical barrier to it. The timestamp thing isn't supplementary info, it actually changes the answer significantly.
    – cpast
    Commented Mar 20, 2015 at 19:23
  • @cpast you didn't get it either as didn't the question-OP. I bolded "the inter-CA's public key" to emphasize it is that same key when an inter-CA is trusted by multiple Root CAs. There will be multiple certificates containing both the inter-CA's name & the inter-CA's public key, and each of these certs is signed by a Root CA.
    – guest
    Commented Mar 20, 2015 at 20:39
  • @cpast and how does mentioning timestamp change the answer significantly?
    – guest
    Commented Mar 20, 2015 at 20:44
  • 1
    @guest Because Thomas's answer was "You can't use this certificate in a validation chain anymore;" your edit is "In XYZ circumstances you can still use this certificate in a validation chain." Going from "You can't do X" to "You can't do X unless Y" is a significant change, which only the author of the post should make.
    – cpast
    Commented Mar 20, 2015 at 20:57
  • Why don't you just write a better answer? Commented Mar 21, 2015 at 7:33
  • @DavidPostill my new answer would overlap in content with this answer, so i prefer editing existing one. also new answer means less vote-up then existing one => less likely be read, then my effort is wasted.
    – guest
    Commented Mar 21, 2015 at 16:23
  • <Shrug> Only a suggestion, your choice ... :/ Commented Mar 21, 2015 at 16:30

1 Answer 1

16

I'm not going to dispute whether you're right about what happens when a CA is revoked, or Thomas is. The truth is, I don't have the expertise to know.

The fact is, Thomas reckons one thing, you reckon another. You might be right, or Thomas might be right. However, Thomas thinks he's right, and it's his answer... so you can't (even by suggested edits) change what Thomas wrote to what you think he should have wrote.

If you do that, your edit should get rejected for:

This edit deviates from the original intent of the post. Even edits that must make drastic changes should strive to preserve the goals of the post's owner.

... which is what (rightly) happened here.

Use suggested edits for fixing typos, or adding supplementary (and complementary) information. Not for fixing information you think is wrong. If you want to do that, downvote the post, or leave a comment, or add a competing answer.

3
  • In fact I only added supplementary info (the timestamp stuff) and rephrase his answer to clear confusion for future reader. I in fact kept his original intent. If I just make a new answer on timestamping that would be too trivial for an answer alone. It would be much comprehensive if these pieces of info stay together.
    – guest
    Commented Mar 20, 2015 at 16:37
  • 6
    @guest short version is this is something in which Stack Exchange does not handle well. On one hand we want clear, complete, and accurate answers, but on the other hand, editing in information into another user's post is effectively putting words in someone's mouth, and then you run into issues with expertise and who is right/wrong. The community has effectively decided that editing answers to add information should be done only in very limited cases to limit these problems. Commented Mar 20, 2015 at 16:55
  • 5
    @guest A comment under the answer explaining your thoughts might be best. The author is an active user and should see your comment. He could then decide to make the edit himself if he agrees with your position. Commented Mar 20, 2015 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .