Subject: RE: Question about CRL DP

From: Sharon Boeyen <[email-masked]>
Date: Tue, 12 Dec 2000 08:20:09 -0500

The CRL distribution points extension can appear in either a CA-certificate
or an end-entity certificate. Regardless of the certificate type, the
revocation list pointed to is one that would list the certificate (if it had
been revoked) that contains the extension. So, if you find the extension in
a CA-certificate it is pointing to an ARL (or a CRL that contains revocation
notices for CA-certificates). While it is possible that the revocation list
being pointed to also contains revocation notices for end-entity certs, you
can't assume that from this instance of the extension. That would be
indicated separately in the end-entity certs themselves.
 
Hope this helps
Sharon

-----Original Message-----
From: Jayant Sane (Exchange) [mailto:[email-masked]]
Sent: Monday, December 11, 2000 3:52 PM
To: Pkix List
Subject: Question about CRL DP

This might be a naive question. 
 
Is it allowed/std practice to put the CRLDP extension in the issuer(CA) cert
such that the crl pointed to contains/lists revoked end-entity certs (issued
by it). 
I came across following certificate. 
End-entity cert has an AIA extension pointing to its issuer cert and the
issuer cert has both AIA, to its issuer, and CRLDP persumably pointing to a
CRL containing end-entity certs. The specs have'nt been very clear on the
placement of this extension (unless I am overlooking something) -- whether
it is more appropriate to put the CRLDP in the end-entity cert itself as
compared to the CA cert.
The one in the CA could be interpreted as one pointing to the CRL issued its
issuer. 
 
Some clarification would be greatly appreciated.
 
thanks,
Jayant

---

From: Santosh Chokhani <[email-masked]>
Date: Tue, 12 Dec 2000 21:41:25 -0500

RFC 2459 is weak in the area of CRL DP processing.  If you want to do this
securely, please look at Annex B in Draft 2000 version of X.509 standard

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Tuesday, December 12, 2000 8:36 AM
To: Jayant Sane (Exchange)
Cc: Pkix List
Subject: Re: Question about CRL DP

RFC 2459, section 4.2.1.14 says:

    The CRL distribution points extension identifies how CRL information
    is obtained.  The extension SHOULD be non-critical, but this profile
    recommends support for this extension by CAs and applications.
    Further discussion of CRL management is contained in section 5.

    If the cRLDistributionPoints extension contains a
    DistributionPointName of type URI, the following semantics MUST be
    assumed: the URI is a pointer to the current CRL for the associated
    reasons and will be issued by the associated cRLIssuer.  The expected
    values for the URI are those defined in 4.2.1.7. Processing rules for
    other values are not defined by this specification.  If the
    distributionPoint omits reasons, the CRL MUST include revocations for
    all reasons. If the distributionPoint omits cRLIssuer, the CRL MUST
    be issued by the CA that issued the certificate.

We should probably be more explicit in the first sentence.  The CRL DP 
extension tells how to obtain CRL information for the certificate that 
contains the extension.  I will try to improve the sentence before 
son-of-RFC 2459 goes to last call.

Russ

At 03:52 PM 12/11/2000 -0500, Jayant Sane wrote:
>Is it allowed/std practice to put the CRLDP extension in the issuer(CA) 
>cert such that the crl pointed to contains/lists revoked end-entity certs 
>(issued by it).
>issuer cert has both AIA, to its issuer, and CRLDP persumably pointing to 
>a CRL containing end-entity certs. The specs have'nt been very clear on 
>the placement of this extension (unless I am overlooking something) -- 
>whether it is more appropriate to put the CRLDP in the end-entity cert 
>itself as compared to the CA cert.
>The one in the CA could be interpreted as one pointing to the CRL issued 
>its issuer.
>

---

From: Sharon Boeyen <[email-masked]>
Date: Wed, 13 Dec 2000 16:47:11 -0500

Whew, its good when that happens - one less defect report we need to write
to clarify the standard :-)

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Tuesday, December 12, 2000 12:18 PM
To: Sharon Boeyen
Cc: 'Jayant Sane (Exchange)'; Pkix List
Subject: RE: Question about CRL DP

Sharon:

Thanks for the more complete answer than the one that I posted.  And, we
gave consistent answers.

Russ

At 08:20 AM 12/12/2000 -0500, Sharon Boeyen wrote:

Hope this helps
Sharon

-----Original Message-----
From: Jayant Sane (Exchange) [ mailto:[email-masked]
<mailto:[email-masked]> ]
Sent: Monday, December 11, 2000 3:52 PM
To: Pkix List
Subject: Question about CRL DP

 
 
thanks,
Jayant