3.1.5 Message Processing Events and Sequencing Rules

In addition to the required ([RFC4556] section 3.1.1) and recommended ([RFC4556] section 3.1.2) algorithms, PKCA supports the rc2-cbc ([RFC4556] section 3.1.4) algorithm. An implementer SHOULD<12> specify des-ede3-cbc ([RFC4556] section 3.1.2) as the default algorithm.

PKCA does not implement the id-pkinit-san algorithm ([RFC4556] section 3.2.2).

PKCA SHOULD<13> support the PKINIT Freshness Extension [RFC8070].