# Not collecting expired certificates? **URL:** \ **Category:** Gateway\ **Created:** [May 9, 2011, 8:53am UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185 "2011-05-09T08:53:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![lst\_hoe021](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@lst\_hoe021](https://community.ciphermail.com/u/lst_hoe021)\ **Post date:** [May 9, 2011, 8:53am UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/1 "2011-05-09T08:53:46Z")
Hello today i discovered that if a mail is signed by i expired certificate the certificate is still fetched and added to the Djigzo store. Is this useful in any case or wouldn't it be better to ignore expired certificates? Regards Andreas ---
**Author:** ![Christine](https://avatars.discourse-cdn.com/v4/letter/c/8491ac/32.png) [@Christine](https://community.ciphermail.com/u/Christine)\ **Post date:** [May 9, 2011, 11:31am UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/2 "2011-05-09T11:31:17Z")
Does it harm to store them? If you store a cert that expires one day later, you also have an expired cert. If someone decides to sign their messages with an expired cert, there may be a reason for that. I generally don't mind expired certs. I think Djigzo shouldn't thow away certs with which messages have been signed. dagdag Christine > **···** > > On 05/09/2011 10:53 AM, lst\_hoe02(a)kwsoft.de wrote: > > > today i discovered that if a mail is signed by i expired certificate > > the certificate is still fetched and added to the Djigzo store. Is > > this useful in any case or wouldn't it be better to ignore expired > > certificates? ---
**Author:** ![Nancy\_Anthracite](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nancy\_Anthracite](https://community.ciphermail.com/u/Nancy_Anthracite)\ **Post date:** [May 9, 2011, 12:23pm UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/3 "2011-05-09T12:23:51Z")
It might make sense to always store them but not necessarily to "use" them. It provides sort of a "paper trail" for sensitive messages which I think I would want for medical data, which is what we will be using Djigzo for. However, I am opened to being talked out of that position. > **···** > > On Monday, May 09, 2011, Christine Karman wrote: > > > On 05/09/2011 10:53 AM, lst\_hoe02(a)kwsoft.de wrote: > > \> today i discovered that if a mail is signed by i expired certificate > > \> the certificate is still fetched and added to the Djigzo store. Is > > \> this useful in any case or wouldn't it be better to ignore expired > > \> certificates? > > > > Does it harm to store them? If you store a cert that expires one day > > later, you also have an expired cert. If someone decides to sign their > > messages with an expired cert, there may be a reason for that. I > > generally don't mind expired certs. I think Djigzo shouldn't thow away > > certs with which messages have been signed. > > > > dagdag > > Christine > > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ > > Users mailing list > > Users(a)lists.djigzo.com > > [http://lists.djigzo.com/lists/listinfo/users](http://lists.djigzo.com/lists/listinfo/users) > > -- > Nancy Anthracite ---
**Author:** ![lst\_hoe021](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@lst\_hoe021](https://community.ciphermail.com/u/lst_hoe021)\ **Post date:** [May 9, 2011, 12:28pm UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/4 "2011-05-09T12:28:53Z")
Zitat von Christine Karman \: > > today i discovered that if a mail is signed by i expired certificate > > the certificate is still fetched and added to the Djigzo store. Is > > this useful in any case or wouldn't it be better to ignore expired > > certificates? > > Does it harm to store them? If you store a cert that expires one day > later, you also have an expired cert. If someone decides to sign their > messages with an expired cert, there may be a reason for that. I > generally don't mind expired certs. I think Djigzo shouldn't thow away > certs with which messages have been signed. Djigzo does apply PKI rules, so it obeys expiring dates. With this expired certificates are somewhat useless. One might argue that it doesn't hurt (much) to store it today, but i disklike systems collecting garbage because it might be useful somehow in the future. If someone decide to use expired certificates, all mailclients used today will show all sorts of errors, so it is discouraged anyway. Regards Andreas > **···** > > > On 05/09/2011 10:53 AM, lst\_hoe02(a)kwsoft.de wrote: ---
**Author:** ![lst\_hoe021](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@lst\_hoe021](https://community.ciphermail.com/u/lst_hoe021)\ **Post date:** [May 9, 2011, 12:33pm UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/5 "2011-05-09T12:33:58Z")
Zitat von Nancy Anthracite \: > It might make sense to always store them but not necessarily to "use" them. > It provides sort of a "paper trail" for sensitive messages which I think I > would want for medical data, which is what we will be using Djigzo for. > However, I am opened to being talked out of that position. With this you need to store the certificates along with the mail in question, no? So Djigzo might not be the right place where this happens. Regards Andreas ---
**Author:** ![Nancy\_Anthracite](https://avatars.discourse-cdn.com/v4/letter/n/3be4f8/32.png) [@Nancy\_Anthracite](https://community.ciphermail.com/u/Nancy_Anthracite)\ **Post date:** [May 9, 2011, 12:42pm UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/6 "2011-05-09T12:42:31Z")
Well right now the medical record software doesn't see the certificates and might not see the email if it is set to be rejected. I am going to have to think some more about that. > **···** > > On Monday, May 09, 2011, lst\_hoe02(a)kwsoft.de wrote: > > > Zitat von Nancy Anthracite \: > > \> It might make sense to always store them but not necessarily to "use" > > \> them. It provides sort of a "paper trail" for sensitive messages which I > > \> think I would want for medical data, which is what we will be using > > \> Djigzo for. However, I am opened to being talked out of that position. > > > > With this you need to store the certificates along with the mail in > > question, no? So Djigzo might not be the right place where this happens. > > > > Regards > > > > Andreas > > -- > Nancy Anthracite ---
**Author:** ![martijn](https://dub1.discourse-cdn.com/flex017/user_avatar/community.ciphermail.com/martijn/32/127_2.png) [@martijn](https://community.ciphermail.com/u/martijn)\ **Post date:** [May 12, 2011, 3:17pm UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/7 "2011-05-12T15:17:11Z")
For both sides (adding it and not adding it) there are valid arguments. You are right that the certificate is no longer usable and it's therefore better not to add it (unless you add the certificate to the CTL manually and allow it to be expired). However, it adding it also helps the gateway administrator to see that a message was signed with an expired certificate. If the certificate was not added the gateway administrator would not have seen that the message was signed with an expired cert. Do you want it to be optional whether to add the certificate when the certificate is expired? Kind regards, Martijn > **···** > > On 01/-10/-28163 08:59 PM, lst\_hoe02(a)kwsoft.de wrote: > > > Hello > > > > today i discovered that if a mail is signed by i expired certificate the > > certificate is still fetched and added to the Djigzo store. Is this > > useful in any case or wouldn't it be better to ignore expired certificates? ---
**Author:** ![lst\_hoe021](https://avatars.discourse-cdn.com/v4/letter/l/58956e/32.png) [@lst\_hoe021](https://community.ciphermail.com/u/lst_hoe021)\ **Post date:** [May 12, 2011, 4:42pm UTC](https://community.ciphermail.com/t/not-collecting-expired-certificates/185/8 "2011-05-12T16:42:09Z")
Zitat von Martijn \: > **···** > > > On 01/-10/-28163 08:59 PM, lst\_hoe02(a)kwsoft.de wrote: > > > > > Hello > > > > > > today i discovered that if a mail is signed by i expired certificate the > > > certificate is still fetched and added to the Djigzo store. Is this > > > useful in any case or wouldn't it be better to ignore expired certificates? > > > > For both sides (adding it and not adding it) there are valid > > arguments. You are right that the certificate is no longer usable > > and it's therefore better not to add it (unless you add the > > certificate to the CTL manually and allow it to be expired). > > However, it adding it also helps the gateway administrator to see > > that a message was signed with an expired certificate. If the > > certificate was not added the gateway administrator would not have > > seen that the message was signed with an expired cert. Do you want > > it to be optional whether to add the certificate when the > > certificate is expired? > > No, it is not that important to add another config option. If it is > really useful for someone to store expired certificates leave it that > way. We manually delete all expired certificates anyway so they get > trashed on this occasion again. > > Regards > > Andreas