Subject: Re: Briefing on CRL Path for IETF PKIX WG Meeting

From: Peter Sylvester <[email-masked]>
Date: Thu, 18 Nov 2004 16:21:16 +0100 (MET)

CA1->CA2  with nameing constraints permitted XYW2 means:

  CA1 issued a certificate to CA2 and sets a permitted subtree allowing
  CA2 to issue certs starting with XYZ2 

CA1->CA2  with nameing constraints permitted XYW2 means:

  CA1 issues a certificate to CA3 and sets a permitted subtree allowing
  CA3 to issue certs starting with XYZ3 

CA2 and CA3 want to use CA1 as CRLissuer, i.e. that the rule
in the policy agreed with CA1. Thus they set crlUssuer = CA1 in
all certs they they create. 

But CA2 and CA3 cannot issue a certificate with a DN=CA1 with a CRLSign bit
since this would violate the naming constraints in that path!

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 19 Nov 2004 10:12:43 +0100

Peter,

>since this would violate the naming constraints in that path!
You say that this is incompatible with naming constraints.
One solution would be to remove or change naming constraints.

Denis