Subject: Inconsistency between X.509-97 and RFC 2459 (and son of RFC 2459)

From: "Ismo Heikkonen" <[email-masked]>
Date: Mon, 15 May 2000 15:20:41 +0300

Hi,
it seems to me that there is an inconsistencty between X.509-97 and RFC 2459 (and also son of RFC2459). 

In X.509 , in section 11.2  there is the following note just after the CRL definition:

"3 If any extensions included in a CertificateList are defined as critical, the version element of the CertificateList shall be present.  If no extensions defined as critical are included, the version element shall be absent. This ..."

But RFC 2459 requires that version shall be present always when the 
extensions are included: 
"5.1.2.1  Version

   This optional field describes the version of the encoded CRL.  When
   extensions are used, as required by this profile, this field MUST be
   present and MUST specify version 2 (the integer value is 1)."

This means that I can not create CRLs which do not include any critical extensions so 
that they would be compatible with both X.509-97 and RFC 2459.
Or are there any X.509 Defect reports available around this topic?

By the way  X.509 -2000 seems to be more flexible in this sense. 

Ismo Heikkonen
Sonera SmartTrust Ltd

---

From: Sam Schaen <[email-masked]>
Date: Mon, 15 May 2000 09:01:47 -0400

We stumbled across this inconsistency while working on the US DOD PKI
profile.  We elected to go with the RFC 2459 interpretation.  It seems
to make more sense, since a version 1 CRL interpreter would not
understand extensions at all.

Sam Schaen
MITRE