Subject: [pkix] Issuing Distribution Point extension understanding

From: Security Developer <[email-masked]>
Date: Mon, 25 Jul 2016 19:51:09 +0500

Dear All,

Could any body please explain the Issuing Distribution Point extension in
CRL? Thanks

As per RFC 5280, the description seems bit cryptic to me.

Regards,

---

From: Erwann Abalea <[email-masked]>
Date: Mon, 25 Jul 2016 17:22:30 +0200

Bonjour,

This extension allows the CRL issuer (generally the CA) to declare that the
given CRL is of a limited scope, i.e. that this CRL only covers a subset of
all the certificates covered by the CRL issuer.

If this extension is not present, then the CRL provides a revocation status
for all the certificates under the CRL issuer's responsibility.

The certificates covered by the CRL issuer can be segmented by User/CA
certificate types, by revocation reasons, or by distribution point (which
will be present in the CRLDP extension of those certificates).

-- 
Erwann.