Subject: Re: Question about Certificate Issuer CRL Entry Extension

From: Russ Housley <[email-masked]>
Date: Sun, 13 Jul 2003 10:41:42 -0400

Steve:

>The Certificate Issuer CRL entry extension (described in
>section 5.3.4 of RFC 3280) is a GeneralNames structure
>that identifies the certificate issuer for the CRL entry
>to which it is attached (and also to all subsequent entries
>in that CRL until another Certificate Issuer CRL entry
>extension is encountered.
>
>RFC 3280 doesn't say so, but I believe that within a PKIX
>(Internet) environment (where each certificate must have a
>non-empty X.500 issuer name and issuer alternative names are
>generally ignored) this extension MUST always contain at
>least one X.500 name so that the relying party can match
>this name against the issuer name in the certificate, as
>described in section 6.3.3 item (j) of RFC 3280. And I think
>that text describing this requirement should be added to the
>successor to RFC 3280. Does everyone agree with this?

I agree.  In fact, I see no value in including any other name forms.

>I also wonder whether anyone can think of a reason why this
>CRL entry extension should ever contain anything other than
>a single X.500 name in a PKIX (Internet) environment. If not,
>then the requirement can (and should) be made even more strict,
>specifying that this extension MUST contain only a single X.500
>name. Please let me know if you have a reason why this would not
>be a good idea.

I would like to see this changed in son of RFC 3208 (Grandson of RFC 2459).

Russ

---

From: Sharon Boeyen <[email-masked]>
Date: Mon, 14 Jul 2003 10:37:06 -0400

I agree with this as well.

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Sunday, July 13, 2003 10:42 AM
To: Steve Hanna; PKIX List
Subject: Re: Question about Certificate Issuer CRL Entry Extension 

Russ