Subject: [pkix] Use case of nameRelativeToCRLIssuer

From: Security Developer <[email-masked]>
Date: Thu, 21 Jul 2016 11:28:03 +0500

Dear All,

CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint

   DistributionPoint ::= SEQUENCE {
        distributionPoint       [0]     DistributionPointName OPTIONAL,
        reasons                 [1]     ReasonFlags OPTIONAL,
        cRLIssuer               [2]     GeneralNames OPTIONAL }

   DistributionPointName ::= CHOICE {
        fullName                [0]     GeneralNames,
        nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

Could any body please explain the use case when
nameRelativeToCRLIssuer should be used? Thanks

---

From: Sean Leonard <[email-masked]>
Date: Thu, 21 Jul 2016 01:57:37 -0700

X.509 (2012) says:

 The nameRelativeToCRLIssuer  component can be used only if the CRL distribution point is assigned a
distinguished name that is directly subordinate to the distinguished name of the CRL issuer. In this case, the
nameRelativeToCRLIssuer  component conveys the relative distinguished name with respect to the CRL issuer
distinguished name.

Basically to get the DN where you can find the CRL, you combine the CRL issuer’s DN and append the nameRelativeToCRLIssuer. The point is to search the Directory for that full DN to get the associated certificateRevocationList (2.5.4.39) attribute (Clause 11.2.4 of X.509).

Does anyone implement this in practice? Maybe, with LDAP. Someone posted to Server Fault asking for this exact thing, although they didn’t say it was to be used with LDAP: <http://serverfault.com/questions/764667/how-to-add-namerelativetocrlissuer-to-crl-using-openssl>.

Sean

> On Jul 20, 2016, at 11:28 PM, Security Developer <[email-masked]> wrote:
> 
> Dear All,
> 
> Could any body please explain the use case when nameRelativeToCRLIssuer should be used? Thanks