Subject: 3280bis: indirectCRL boolean in IDP (3/3)

From: Denis Pinkas <[email-masked]>
Date: Sat, 13 Nov 2004 14:59:54 +0100

3280bis: indirectCRL boolean in IDP (3/3)

This is a change and an addition proposal related to indirect CRLs.

From section 5.2.5 Issuing Distribution Point, "the CRL issuer MUST
assert the indirectCRL boolean, if the scope of the CRL includes
certificates issued by authorities other than the CRL issuer".

This sentence is incorrect since CRL issuers do not issue
certificates.  

Proposed correction: 

"The CRL issuer MUST assert the indirectCRL boolean, if the scope of
the CRL includes certificate identifiers from multiple authorities"
 
This boolean indicates a type b) indirect CRL but is named indirectCRL
boolean which is confusing with type a) indirect CRLs.

A note should be mentioned to clarify the ambiguity of the naming.

Proposed note: 

"The name of the boolean "indirectCRL" designates an indirect CRL that
includes certificate identifiers from multiple authorities, and not an
indirect CRL that includes certificate identifiers from a single CA.
An alternative name for that boolean would be: multipleCAs."

Denis

---

From: Stephen Kent <[email-masked]>
Date: Thu, 18 Nov 2004 12:36:03 -0500

James,

I agree with you broader interpretation of the term "CRL Issuer." I 
think it was introduced in X.509 to accommodate both the traditional 
case of a CA issuing CRLs and a non-CA, issuing only CRLs.

Steve