Subject: RE: keyCertSign and cRLSign Key Usage Bits

From: Stephen Kent <[email-masked]>
Date: Sat, 28 Apr 2001 15:03:04 -0400

At 8:46 PM -0400 4/25/01, Dave Oshman wrote:
>Steve--
>2459 does not seem to disallow this now. It is simply not clear on 
>it. I agree that the standard needs to be unambiguous. We need to 
>clearly define what CA=true means. If it means the PK in this cert 
>is used to verify signatures on certificates, then this means that 
>the CA flag should not be set for a CRL Signing certificate.
>Regards,
>Dave

Dave,

Neither X.509 not 2459 name any entity other than a CA than can sign 
CRLs and both refer to CAs or to "authorities" extensively in their 
discussion of CRLs and mandated requirements re CRL issuance. So, 
while I agree that there is some syntactic ambiguity here, there has 
not been semantic ambiguity.

Steve