Subject: Re: Signer certificate discovery for CRLs

From: Peter Sylvester <[email-masked]>
Date: Fri, 22 Oct 2004 14:09:22 +0200 (MEST)

> 
> My suggestion is base on the curent practice I am aware of, not based
> on any spec or standard.
> I believe that currently there is no spec to tell us what kind of objects
> an AIA caIssuers URI will point to. The current definition of AIA in
> RFC 3280 is too vague. I think that Stefan's proposal of
> expanding the scope of AIA is a chance to clarify this.

I would second the idea to put this on the list of issues for an
update of 3280, ooups, the San Diego meeting proceedings say
'list of open issues compiled'. 

> 
> For MIME types, RFC 2585 and RFC 2633 already defined some
> useful types for cert, crl, or CMS/PKCS#7 object. Unfortunately,
> related HTTP or FTP URI pointers (such as those in an AIA or a CRLDP)
> defined in RFC 3280 have no reference to MIME types defined in RFC 2585
> and RFC 2633.

i'd be careful to allow different mime type together with one access method OID. 

> > Also, Peter Gutmann's new http-certstore does something completely
> > different AFAIS.
> >
> Please note that I am talking about AIA not SIA. For an HTTP
> URI in a SIA, it should follow the spec in Peter Gutmann's new
> http-certstore proposal. I suggest that http-certstore spec should
> have a reference to MIME types defined in RFC 2585.

The difference is not SIA vs AIA IMO, but the format implied by 
accessMethod (which is the same definition for SIA and AIA). 

  " The type and
   format of the information is specified by the accessMethod field;" 

> Wen-Cheng Wang
Peter

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 22 Oct 2004 16:33:54 +0200

Peter,

I support your position.

> 'list of open issues compiled'. 

We need a document to list all "agreed changes" and pending issues.

>    format of the information is specified by the accessMethod field;" 

We need to say more about the formats implied by accessMethod.
There are four possible cases :

  - it allows to retrieve one single file,
  - it allows to query for a single file in a repository,
  - it allows to query for one or more files in a repository,
  - it provides the address of a repository.

The current text is not crystal clear.

Denis