Subject: RE: Signer certificate discovery for CRLs

From: Peter Sylvester <[email-masked]>
Date: Wed, 27 Oct 2004 16:19:10 +0200 (MEST)

SMIME seems to work with an information that just has
'issuername+serialnumber' to point to th certificate
that is used for signing. 

A similar information can be made available in the
AuthorityKeyIdentifier, i.e. point to a cert that
has a key that has signed the cert or crl. 

What is missing here:

-  A generic way to map this value to some repository request? 
-  To indicate an explicit mapping (at a near place)?  

I also do not really remember that the id-ad-caRepository
SIA extension had been actually proposed in 2000, it simply
appeared in part1-new-03.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 27 Oct 2004 16:55:31 -0400

Peter,

The extensions you identified help when you have a directory or the client
can do LDAP or DAP.  AIA can be used when there is no directory or the
client does not have wherewithal to query LDAP attributes.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Sylvester
Sent: Wednesday, October 27, 2004 10:19 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: RE: Signer certificate discovery for CRLs

SMIME seems to work with an information that just has
'issuername+serialnumber' to point to th certificate that is used for
signing. 

A similar information can be made available in the AuthorityKeyIdentifier,
i.e. point to a cert that has a key that has signed the cert or crl. 

What is missing here:

I also do not really remember that the id-ad-caRepository
SIA extension had been actually proposed in 2000, it simply appeared in
part1-new-03.