Subject: A question and comment about PKIX - Part 1, Version 11.

From: [email-masked]
Date: Mon, 28 Sep 1998 14:55:42 -0700

First the question.   In Section 5.2 "CRL Extensions", p. 46, it says:

     "A CRL validation MUST fail if it encounters a critical extension
which it does not know how to process".

My question is exactly what does it means that a "CRL validation fails"?.
Does this mean that the CRL is to be ignored and that any certificates that
might appear on the CRL are not invalidated by the CRL?.  I would suppose
it is that interpretation rather than that a certificate validation fails
if such a CRL is encountered.

And now a minor comment.  I notice that RFC 2044 (on UTF8 strings) has been
obsoleted by RFC 2279.  The comment is just to update the RFC reference in
the spec in Appendix A.1 under UTF8String (p.69).

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 28 Sep 1998 15:31:45 -0700

>the spec in Appendix A.1 under UTF8String (p.69).

Yes, please, since RFC 2279 had some technical corrections to RFC 2044, I
believe.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Russ Housley <[email-masked]>
Date: Tue, 29 Sep 1998 13:30:03 -0400

Allen:

It means that the data in the CRL cannot be used to validate any
certificates.  Another source of revocation information must be used.

Russ