Subject: Delta CRL and CRL entries

From: Brian Hunter <[email-masked]>
Date: Wed, 12 Jun 2002 18:18:14 +0200

Hello,

I was hoping that someone could clarify this for me.

In the context of a DPV service, I have been trying to decide what CRLs must be
saved in order to archive sufficient information such that a future query to the
server can provide the same status result as the original request for the same
certificate.  Obviously, I could archive all CRLs and delta CRLs (and OCSP) that
have been used, but I would like to be able to throw away as many as possible
but still be able to find the same result or justify my original result.

My question is, can a certificate appear on the same CRL more than once, with
different revocation reasons?  e.g. certificateHold and removeFromCRL.  I don't
find that 5.1.2.6 in RFC 3280 clearly states that this is not possible.

My question is based on the following situation:

        CRL1                        CRL5
|-----------------------------||----------------------------------|

     d CRL2      d CRL3     d CRL4
   |--------||----------||----------|
     b=1         b=1         b=1
  ^       ^
  |       |
 Hold     |
      removeFromCRL

Where d = delta
      b = basis for delta CRL

My scenario is, the certificateHold is first recorded in CRL2.  CRL3 includes
the removeFromCRL entry and CRL4 must also.  What would (or could) CRL5
contain?  Would it contain:
  1-nothing
  2-removeFromCRL, or
  3-certificateHold and removeFromCRL?

My concern is that if the case is 1 or 2, then storing complete CRLs would not
contain all status changes to certificates.  That is, if I validated based on
CRL2 but only stored CRL1 and CRL5, I could never prove that my validation was
correct in saying "suspended" at that given moment.  I originally thought that
storing all complete CRLs would be sufficient but this could prove me wrong.

Thanks for any help and sorry for the long example.

Brian

---

From: "Housley, Russ" <[email-masked]>
Date: Wed, 12 Jun 2002 16:47:59 -0400

Brian:

I would expect a revoked (or suspended) certificate to appear only once on 
a CRL.  However, I could not find any text to support (or to refute) this 
position.  I looked in RFC 3280 and the 4th Edition of X.509.

Russ

---

From: Marc Branchaud <[email-masked]>
Date: Wed, 12 Jun 2002 17:36:12 -0700

I believe CRL5 would contain no mention of the certificate, and that 
merely archiving the base CRLs would not be enough for you to retain 
proof that the cert was temporarily suspended.  The reason is simply 
because the suspension period was contained entirely within the validity 
period of base CRL1.  In other words, the base CRLs did not have a fine 
enough granularity to capture what happened to the certificate.

Note that the problem also exists with the delta CRLs.  That is, a cert 
could be suspended and reinstated within the lifetime of a single delta 
CRL, and the world would be none the wiser (unless the CA published some 
kind of emergency-CRL before the notAfter time of the delta CRL).

I think you're stuck archiving the delta CRLs, at least to the extent 
that the deltas contain information that isn't shown in the base CRLs.

		M.