ETSI EN 319 411-1 How should certificate authorities handle suspension under ETSI EN 319 411-1

Treat suspension as part of the same controlled certificate-status process as revocation, while keeping the two outcomes distinct. A definitive revocation cannot be reinstated under EN 319 411-1; suspension is useful only where the applicable certificate policy, CPS, customer terms, and status systems can represent a temporary invalid state without confusing relying parties.

The CPS must describe whether and for what reasons certificates can be suspended or revoked, who may submit requests or event reports, the request and confirmation process, the status-distribution mechanism, and the maximum delays. EN 319 411-1 sets an outer timing rule: changed status information must be available to all relying parties within 24 hours after receipt of a revocation or suspension request. If a request schedules suspension for a future date, that date may count as the receipt time.

The evidence should show both the decision and the status-system result. A reviewer should be able to see who requested suspension, how the CA authenticated and authorized the source, whether confirmation was required, when the request arrived, what certificate and policy were affected, when the status changed, which CRL or OCSP channel carried the new status, and whether the subject or subscriber was notified.

EN 319 411-1 also requires status information to be available continuously, protected for integrity and authenticity, and available at least until certificate expiry. Where a CA supports both CRL and online certificate status service methods, updates must be available for all methods and the information must stay consistent over time, taking different update delays into account.

A CA should offer suspension only when the surrounding policy, repository, and status-service design can make the temporary state unambiguous. Operational delay and inconsistent treatment both create problems: relying parties, subscribers, auditors, customer contracts, and the CA's status infrastructure need the same interpretation.

Before enabling or continuing suspension, compare the certificate policy, CPS, subscriber agreement, relying-party notice, CRL profile, OCSP behavior, repository wording, and incident or compromise procedures. The documents and systems should tell the same story about when suspension is available, how long it can last, who can request it, and what happens next.