[Feature Request] Certificate revocation in SCS-0007

[fkr]

We noticed that SCS-0004 contains a process for certificate revocation while SCS-0007 does not contain this.

I'm not sure that we should simply adopt the passage from SCS-0004 since it also contains a passage about a public CRL. I'm not aware of other certifications such as BSI C5, ISO270001 where revoked certificates are publicly listed.
It is important to distinguish this from expired certificates.

[depressiveRobot]

Without a public CRL, how can we say that a provider is no longer certified? On the other hand, we just could remove it from the webpage https://sovereigncloudstack.org/en/scs-standards/certified-providers/ and prohibit advertising with badges etc.

[fkr]

The companies that are certified are only allowed to use the certificate (/badges) as long as they're are certified, so if a certificate is revoked, they're not allowed to advertise with it any longer. Doesn't that suffice? Are there any other certificates (ISO 270001 or BSI C5 as examples) that have public CRLs?
A public CRL seems a bit like a pillory - doesn't it?

[mbuechse]

From my POV, explicit is better than implicit. If a company is listed one day and isn't listed the next, this makes me wonder why that is. Could be a mistake, could also be that my eyes are fooling me. I would like to know what's going on. What has happened, and also maybe when and why? Also, there's a clear difference between expiry, revocation by the issuer and "cancellation" by the other party.

[mbuechse]

Besides, it's just the other side of the coin: if you want to advertise with a certificate in public, you have to be ready for your failure to become public as well.