Subject: RE: Reason codes vs Reason flags

From: [email-masked]
Date: Thu, 14 Jan 1999 10:52:57 -0500

Carlisle,
Can you offer an alternative from John's list (or yet another
one) about what to do about the mismatch then? As a refresher,
he said:

What should a CA do if it receives a CMP revocation request with more than one
reason bit set?  Should it somehow prioritize the reasons, and put only the
"most important reason" into the CRL?  Should it put multiple revocation entries
in the CRL, one for each requested reason?  Should it reject the request as
mal-formed?  Should CMP use CRLReason instead of ReasonFlags?

     Mez

---

From: Russ Housley <[email-masked]>
Date: Sat, 16 Jan 1999 12:39:55 -0500

Mez:

The CRL, as defined in X.509 and profiled in Part 1, does not permit multiple
reasons.

   id-ce-cRLReason OBJECT IDENTIFIER ::= { id-ce 21 }

   -- reasonCode ::= { CRLReason }

   CRLReason ::= ENUMERATED {
        unspecified             (0),
        keyCompromise           (1),
        cACompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6),
        removeFromCRL           (8) }

Russ