Subject: Re: Signer certificate discovery for CRLs

From: Peter Sylvester <[email-masked]>
Date: Wed, 20 Oct 2004 13:25:50 +0200 (MEST)

> From [email-masked] Tue Oct 19 04:13:28 2004
> Return-Path: <[email-masked]>
> Message-ID: <008301c4b581$32882b90$4f85900a@wcwang>
> From: "Wen-Cheng Wang" <[email-masked]>
> To: "Santosh Chokhani" <[email-masked]>, <[email-masked]>,
>    "Peter Sylvester" <[email-masked]>
> References: <[email-masked]>
> Subject: Re: Signer certificate discovery for CRLs
> Date: Tue, 19 Oct 2004 10:13:16 +0800
> Organization: Chunghwa Telecom
> MIME-Version: 1.0
> X-scanner: scanned by Inflex 1.0.10 - (http://pldaniels.com/inflex/)
> More specifically, for a LDAP URI it could point to the crossCertificatePair
> attribute or the caCertificate attribute of a CA's directory entry; for a
> HTTP
> URI or a FTP URI it could point to a cert-only CMS/PKCS#7 file (please see
> section 3.6 of RFC 2633).
> Both a LDAP attribute and a CMS/PKCS#7 file can contains multiple
> certificates.

"it could point" but where is a spec? What kind of mime types
should a client be prepared to get in case of an HTTP URI
in some SIA or AIA? 

Also, Peter Gutmann's new http-certstore does something completely
different AFAIS.

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Thu, 21 Oct 2004 11:17:12 +0800

> should a client be prepared to get in case of an HTTP URI

My suggestion is base on the curent practice I am aware of, not based
on any spec or standard.
I believe that currently there is no spec to tell us what kind of objects
an AIA caIssuers URI will point to. The current definition of AIA in
RFC 3280 is too vague. I think that Stefan's proposal of
expanding the scope of AIA is a chance to clarify this.

For MIME types, RFC 2585 and RFC 2633 already defined some
useful types for cert, crl, or CMS/PKCS#7 object. Unfortunately,
related HTTP or FTP URI pointers (such as those in an AIA or a CRLDP)
defined in RFC 3280 have no reference to MIME types defined in RFC 2585
and RFC 2633.

> Also, Peter Gutmann's new http-certstore does something completely
Please note that I am talking about AIA not SIA. For an HTTP
URI in a SIA, it should follow the spec in Peter Gutmann's new
http-certstore proposal. I suggest that http-certstore spec should
have a reference to MIME types defined in RFC 2585.

Wen-Cheng Wang