Subject: Re: What is the meaning of the "indirectCRL" flag

From: "David P. Kemp" <[email-masked]>
Date: Wed, 31 May 2000 12:03:19 -0400 (EDT)

> From: "Bob Jueneman" <[email-masked]>
> 
> Presumably the relying party's Enterprise should be allowed to issue in 
internal-only CRL 
> or the equivalent, and have it be accepted by the various relying parties, so 
long as that 
> Enterprise's certificate is in the relying party's cache of trusted CA 
certificates, whether
> or not the name of that Enterprise had previously be listed in the Certificate 
Issuer Extension.

A CRL revokes the binding between identity, key, and attributes that
the CA established in the first place.

If the Enterprise wants to revoke the privileges of a now-untrusted user,
it should do something other than claim that the binding established
by the certificate is no longer valid.  (Unless the binding actually *is*
no longer valid, in which case the Enterprise should request that the CA
revoke the certificate.)