Subject: Re: Signer certificate discovery for CRLs

From: Peter Sylvester <[email-masked]>
Date: Mon, 18 Oct 2004 21:28:49 +0200 (MEST)

As a side remark or a question:

Waht is supposed to be be returned for a value of the id-ad-caRepository
or id-ad-caIssuers in case the value starts with ftp or http?

As far as I understand, the values point to a repository.

of course, in some cases this may degenerate to a single cert.
But what is the information to be returned for a caIssuer if the
ca cert has to higher level (cross) certs. 

Peter

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 18 Oct 2004 16:53:57 -0400

Peter:

I think the pointer as a URI.  I could be LDAP, HTTP or FTP pointer to a
file that contains one or more certificates.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Sylvester
Sent: Monday, October 18, 2004 3:29 PM
To: [email-masked]
Subject: Re: Signer certificate discovery for CRLs

Waht is supposed to be be returned for a value of the id-ad-caRepository or
id-ad-caIssuers in case the value starts with ftp or http?

of course, in some cases this may degenerate to a single cert. But what is
the information to be returned for a caIssuer if the ca cert has to higher
level (cross) certs. 

Peter

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Tue, 19 Oct 2004 10:13:16 +0800

Peter,
> file that contains one or more certificates.
More specifically, for a LDAP URI it could point to the crossCertificatePair
attribute or the caCertificate attribute of a CA's directory entry; for a
HTTP
URI or a FTP URI it could point to a cert-only CMS/PKCS#7 file (please see
section 3.6 of RFC 2633).
Both a LDAP attribute and a CMS/PKCS#7 file can contains multiple
certificates.

Wen-Cheng Wang