Subject: Authority Key Identifier extension for a CRL issued by a subordinate CA

From: "Miguel A Rodriguez" <[email-masked]>
Date: Tue, 5 Jul 2005 12:47:56 -0500

Hi,

Consider a subordinate CA that issues a CRL. Regarding the Authority Key
Identifer extension for the CRL in the "issuer name and serial number"
form. What is the correct name to be included, the one of the
subordinate CA or the one of the root CA?

Thanks in advance,

Miguel Rodriguez
SeguriData 
Mexico

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 5 Jul 2005 15:15:25 -0400

Miguel,

Generally it is not a good idea to use that option for AKID.

But, the value is supposed to represent the certificate issued to the CA.
Thus, the issuer DN should be that of the parent CA that issued a
certificate to the CRL issuing CA (it could be the Root or an intermediate
CA) and the serial number should be that of the certificate issued by the
issuer DN to the CRL issuing CA.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Miguel A Rodriguez
Sent: Tuesday, July 05, 2005 1:48 PM
To: [email-masked]
Subject: Authority Key Identifier extension for a CRL issued by a
subordinate CA

Hi,

Consider a subordinate CA that issues a CRL. Regarding the Authority Key
Identifer extension for the CRL in the "issuer name and serial number" form.
What is the correct name to be included, the one of the subordinate CA or
the one of the root CA?

Thanks in advance,

Miguel Rodriguez
SeguriData 
Mexico