Subject: Re: Briefing on CRL Path for IETF PKIX WG Meeting

From: Peter Sylvester <[email-masked]>
Date: Wed, 17 Nov 2004 16:10:32 +0100 (MET)

> 
> In the following, there is an attempt to define that single method.
> 
> The requirements for the CA would be:
> 
> "The CA that places a CRL DP extension in a certificate with a cRLIssuer
> field present SHALL issue a CRL Issuer certificate for the DN contained
> in that cRLIssuer field".

CA1 : C=WW, O=org1 which issues certs and CRLs for all CAs.

CA1->CA2 : C=WW, O=org2 with this as permitted name space 
CA1->CA3 : C=WW, O=org3 with the permitted name space 

CA2/3 wants to put C=WW, O=org1 into a CRLIssuer, it can do so. 

How can CA2/3 issue a cert to CA1?

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 18 Nov 2004 15:06:13 +0100

Peter,

Your example illustrates once again the naming problem that we
currently have .

A CA does not issue CRLs for other CAs. Only a CRL Issuer can do this.

I do not understand what this notation means.

If I understand correctly, you mean CA2 or CA3 wants to nominate a CRL
Issuer that has the above
DN (i.e. C=WW, O=org1).

CA2 or CA3 will issue a certifcate that has the CRLsign bit set in key
Usage to the entity which has (C=WW, O=org1) as subject name.

There is no certificate "issued to CA1".  There is a certificate issued
by CA2 or CA3 to a CRL issuer that has a given DN.

Denis