Subject: RFC2459 - CRL signature verification?

From: Sean Turner <[email-masked]>
Date: Mon, 24 May 1999 23:31:35 -0400

All,

I've been searching through RFC2459 looking for text that says something
about verifying the signature on the CRL.

Clause 3.3 (2nd paragraph) says:

When a certificate-using system uses a certificate (e.g., for verifying
a remote user's digital signature), that system not only checks the
certificate signature and validity but also acquires a suitably-recent
CRL and checks that the certificate serial number is not on that CRL.

But it stops short of saying 'check the signature on the CRL.' Can
somebody tell me where the requirement to verify the signature on the
CRL before using it is stated? (and to check to see that the right CA
signed it, etc.)

Thanks,

spt