Subject: CDP in self signed root CA

From: "Erwan Smits" <[email-masked]>
Date: Thu, 5 Dec 2002 17:35:59 +0100

We are building a certificate hierarchy with 4 (CA) layers. We want to include a CDP extension in every CA and end user certificate. At the moment we have a discussion about the need for a CDP extension in the Root CA. The argument against it is that it doesn't make sense because there is no supperior CA that can sign the CRL. The argument for a CDP is that for performing a correct path validation the CRL for every CA (including the Root CA) and end-user certificate should be validated.
 
I scanned through RFC 3280, but it doesn't say anything about it. Does anybody have suggestions?
 
Greetings,
 
Erwan Smits

---

From: Russ Housley <[email-masked]>
Date: Thu, 05 Dec 2002 13:35:05 -0500

Erwan:

I assume that by "Root CA" you mean the use of a self-signed certificate to 
establish a trust anchor.  Such self-signed certificates need not include a 
CRL Distribution Point extension.

Russ

At 05:35 PM 12/5/2002 +0100, Erwan Smits wrote:
>We are building a certificate hierarchy with 4 (CA) layers. We want to 
>include a CDP extension in every CA and end user certificate. At the 
>moment we have a discussion about the need for a CDP extension in the Root 
>CA. The argument against it is that it doesn't make sense because there is 
>no supperior CA that can sign the CRL. The argument for a CDP is that for 
>performing a correct path validation the CRL for every CA (including the 
>Root CA) and end-user certificate should be validated.
>

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 5 Dec 2002 14:17:37 -0500

Hi Erwan:
 
I assume that the root CA certificate is the self-signed trust anchor.
In that case, it should NOT be part of the certificates in the chain for
path validation anyway.  Thus, you do not need CDP in it and you should
not verify it and run it through the 3280 path validation state machine.
 
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Erwan Smits
Sent: Thursday, December 05, 2002 11:36 AM
To: [email-masked]
Subject: CDP in self signed root CA

We are building a certificate hierarchy with 4 (CA) layers. We want to
include a CDP extension in every CA and end user certificate. At the
moment we have a discussion about the need for a CDP extension in the
Root CA. The argument against it is that it doesn't make sense because
there is no supperior CA that can sign the CRL. The argument for a CDP
is that for performing a correct path validation the CRL for every CA
(including the Root CA) and end-user certificate should be validated.
 
I scanned through RFC 3280, but it doesn't say anything about it. Does
anybody have suggestions?
 
Greetings,
 
Erwan Smits