Subject: [pkix] Issuing Distribution Point extension

From: "Kyle Hamilton" <[email-masked]>
Date: Mon, 28 Mar 2011 02:47:39 -0700 (Pacific Daylight Time)

Why is Issuing Distribution Point only a CRL extension and not a certificate extension?  If intermediate CA certificates contained their own CRL distribution points (and the addresses of their own OCSP responders!), revocation would become meaningful.

-Kyle H

---

From: Santosh Chokhani <[email-masked]>
Date: Mon, 28 Mar 2011 07:57:35 -0400

Issuing Distribution Point in CRL and CRL Distribution Point in certificate are quite similar to each other.

The only reason IDP is in CRL is to permit the relying party to ensure that they have gotten the correct partition vis-à-vis the certificate in question.  5280 describes this in summary form.  Detailed rationale and processing logic is in Appendix B of X.509.

As to Intermediate CA, all certificate except the trust anchor can have CRL DP and OCSP Responder and revocation checking.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Kyle Hamilton
Sent: Monday, March 28, 2011 5:48 AM
To: [email-masked]
Subject: [pkix] Issuing Distribution Point extension

-Kyle H