Subject: CRL Problem

From: Ismo Heikkonen <[email-masked]>
Date: Tue, 14 Mar 2000 10:36:51 +0200

Hi,
I have the following kind of problem:
I have to create grandmother- mother-child certificate chains. Each
parent will have
one or more children. The only common factors between these three
certificates are
the public key and serial number attribute in
subjectAltName-directoryName field.
Different CA's have signed these certs.

When the upper level certificate is revoked, all child certificates
shall be revoked
also.
A solution could be to have three CRL's, and each certificate  will have
one, two or
three distribution points, where respective  CRL information can be
found. But the
problem is that the child does not know implicitly the
certificateSerialNumber of it's
parent, just the subjectAltName serialNumber. It means that when each
CRL entry
is processed, the respective certificate shall be searched from the
directory, and
subjectAltName --serialNumber attribute picked up. This is too
tedious and resource consuming.

An easier solution would be if I were able to use subjectAltName
extension also in
CRL entry extension. In this case I would be able to add both
certificateSerialNumber and subjectAltName-serialNumber on CRL, and my
application could see easily if the subjectAltName-serialNumber is
revoked or not.

Actually issuerAltName is a legal extension for CRL entry, but
subjetAltName is not,
which is a defect in X.509, I think.

An other solution could be to publish two CRL's: one based on
certificateSerialNumber and the other one based on
subjectAltName-directoryName-serialNumber. I tried with an
implementation, but it can create CRL' s just for it's own certificates.

Have you seen any working solutions for this kind of case? I would not
like to go to
OCSP based solution due to the strict response time and availability
requirements.

Ismo

---

From: Russ Housley <[email-masked]>
Date: Wed, 15 Mar 2000 13:15:56 -0500

Ismo:

The CRL does not include the subject name (in any form).  I think this is 
correct.  Otherwise, the size of the certificate would get significantly 
larger.

Russ