Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

From: "Michael Lursen" <[email-masked]>
Date: Wed, 8 Feb 2006 13:36:11 -0000

Hi,

Can someone please follow up on this email? 

Thanks,

Michaël Lürsen.

________________________________

From: Michael Lursen 
Sent: Monday, January 30, 2006 10:14 AM
To: [email-masked]'
Cc: Edwin Burgstede; [email-masked]'
Subject: [RFC 3280 ] valid URL syntax for CRL? 

Hi,

Can someone please tell me which of these URL's is valid as a URL to a CRL Distribution point:

A.)    http://www.domain.com/directory/list.crl

B.)    http://www.domain.com/directory/

I think only url A is valid, according to the following line from RFC 3280:

"If the cRLDistributionPoints extension contains a general name of type URI, the following semantics MUST be assumed: the URI is a pointer to the current CRL for the associated reasons and will be issued by the associated cRLIssuer."

It is possible to use default document handling to forward URL B to a file. Should this type of URL be accepted?

Thanks in advance.

Kind regards,

Michaël Lürsen |

PS, please use reply all.

---

From: "Michael Lursen" <[email-masked]>
Date: Wed, 8 Feb 2006 15:22:47 -0000

So you are saying that we must accept this type of URL?

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 4:25 PM
To: Riho Raassild; Michael Lursen; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

If directory is a file that contains the CRL, it is fine. I assume that the file resides the filesystem root of the Web Server.

From: Riho Raassild [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 10:15 AM
To: Santosh Chokhani; Michael Lursen; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Hi Santosh

Does it mean that http://www.domain.com/directory/ is wrong, based on this RFC, even it points to a file?

BR 

Riho 

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 5:18 PM
To: Michael Lursen; [email-masked]
Cc: Riho Raassild
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

I agree that option A pointing to the file is the correct one.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Michael Lursen
Sent: Wednesday, February 08, 2006 8:36 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Hi,

Thanks,

Michaël Lürsen.

From: Michael Lursen 

Hi,

Thanks in advance.

Kind regards,

Michaël Lürsen |

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 8 Feb 2006 07:25:24 -0800

Hi Santosh

 

BR 

Riho 

Hi,

Thanks,

Michaël Lürsen.

From: Michael Lursen 

Hi,

Thanks in advance.

Kind regards,

Michaël Lürsen |

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 8 Feb 2006 07:17:34 -0800

Hi,

Thanks,

Michaël Lürsen.

From: Michael Lursen 

Hi,

Thanks in advance.

Kind regards,

Michaël Lürsen |

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 8 Feb 2006 07:32:55 -0800

May be I am missing something.  Can you not simply invoke the HTTP and get the file?

From: Michael Lursen [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 10:23 AM
To: Santosh Chokhani; Riho Raassild; [email-masked]
Cc: Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Hi Santosh

 

BR 

Riho 

Hi,

Thanks,

Michaël Lürsen.

From: Michael Lursen 

Hi,

Thanks in advance.

Kind regards,

Michaël Lürsen |

---

From: "Michael Lursen" <[email-masked]>
Date: Wed, 8 Feb 2006 15:33:35 -0000

Stefan?

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 4:33 PM
To: Michael Lursen; Riho Raassild; [email-masked]
Cc: Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Hi Santosh

 

BR 

Riho 

Hi,

Thanks,

Michaël Lürsen.

From: Michael Lursen 

Hi,

Thanks in advance.

Kind regards,

Michaël Lürsen |

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 8 Feb 2006 07:40:00 -0800

The following is the quote from 3280 Biz:

"If the DistributionPointName contains a general name of type URI, the

   following semantics MUST be assumed: the URI is a pointer to the

   current CRL for the associated reasons and will be issued by the

   associated cRLIssuer.  When the HTTP or FTP scheme is specified, the

   URI MUST point to a CRL file.  The CRL file MUST contain a single DER

   encoded CRL (indicated by the .crl file extension) as specified in

   [RFC 2585].  HTTP server implementations accessed via the URI SHOULD

   use the application/pkix-crl MIME content-type for the CRL containing

   file."

It seems that .CRL extension is required and "directory" alone need not be acceptable.  Note that the language in 2585 is "should" and not "must" for the file name extension.

From: Santosh Chokhani 
Sent: Wednesday, February 08, 2006 10:26 AM
To: 'Michael Lursen'; Riho Raassild; [email-masked]
Cc: Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Hi Santosh

 

BR 

Riho 

Hi,

Thanks,

Michaël Lürsen.

From: Michael Lursen 

Hi,

Thanks in advance.

Kind regards,

Michaël Lürsen |

---

From: "Kemp David P." <[email-masked]>
Date: Thu, 9 Feb 2006 09:18:16 -0500

I would say that this example is valid.   The CDP extension unfortunately serves two purposes: identify a location where a CRL can be obtained, and identify the partition to which the CRL applies.  It would be nice if a particular CRL could be obtained from multiple locations yet still refer to a single partition, but CDP/IDP matching does not enable that.

Because the example URL identifies both a distribution address and a specific partition, it should be considered valid.  A specific filename is not required in the URL, but a filename, when present, serves the purpose of partition identifier.  Bare directory URLs will be deprecated because it is impossible to give CRLs for different partitions the same IDP, and therefore the concept of multiple files in a directory with one being the default won't behave as expected.  

From: [email-masked] [mailto:[email-masked]] On Behalf Of Wen-Cheng Wang
Sent: Wednesday, February 08, 2006 9:09 PM
To: [email-masked]
Subject: Re: [RFC 3280 ] valid URL syntax for CRL? 

Can't it be a URL pointing to a CGI that return a CRL file (with correct MIME type, of course)?

For example:

   http://www.some-ca.com/cgi-bin/get-crl.exe?partition=101

Wen-Cheng Wang

	----- Original Message ----- 

	From: Stefan Santesson <mailto:[email-masked]>  

	To: Michael Lursen <mailto:[email-masked]>  ; Santosh Chokhani <mailto:[email-masked]>  ; Riho Raassild <mailto:[email-masked]>  ; [email-masked] 

	Sent: Thursday, February 09, 2006 1:39 AM

	Santosh is correct.

	Pointing to the location is not enough when using http. The filename must be specified.

	RFC3280bis is made clearer on this point.

	The reason is simple. Just pointing to the location may not be unambiguous since many crl files may reside there.

	Then there is a practical one. We don't want to put the burden on the cert validation logic to figure out what file is intended.

	Stefan Santesson

	Program Manager, Standards Liaison

	Windows Security

	From: Michael Lursen 
	Sent: den 8 februari 2006 16:34
	To: Santosh Chokhani; Riho Raassild; [email-masked]; Stefan Santesson
	Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

	Stefan?

	

	Hi Santosh

	 

	BR 

	Riho 

	

	Hi,

	Thanks,

	Michaël Lürsen.

	From: Michael Lursen 

	Hi,

	Thanks in advance.

	Kind regards,

	Michaël Lürsen |

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 9 Feb 2006 10:03:29 -0800

It seems fine to me also from security and interoperability viewpoint.

But, it seems to violate the following text in 3280 Biz:

"When the HTTP or FTP scheme is specified, the
   URI MUST point to a CRL file.  The CRL file MUST contain a single DER
   encoded CRL (indicated by the .crl file extension) as specified in
   [RFC 2585]."

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Tom Gindin
Sent: Thursday, February 09, 2006 8:45 AM
To: Wen-Cheng Wang
Cc: [email-masked]
Subject: Re: [RFC 3280 ] valid URL syntax for CRL?

        RFC 4387 explicitly recommends URL's of approximately that format 
to retrieve CRL's as well as certs, such as:  
http://www.some-ca.com/cgi-bin/get-crl?sHash=abcDEF1234567890 (although 
that argument would actually be 27 characters long, with the trailing 
equal sign from base 64 conversion omitted).
        This particular form is not ambiguous, and there seems no reason 
it would not be used in a DP extension.
 
                Tom Gindin

"Wen-Cheng Wang" <[email-masked]>
Sent by: [email-masked]
02/08/2006 09:08 PM
 
        To:     <[email-masked]>
        cc: 

Can't it be a URL pointing to a CGI that return a CRL file (with correct 
MIME type, of course)?
For example:
   http://www.some-ca.com/cgi-bin/get-crl.exe?partition=101
 
Wen-Cheng Wang
----- Original Message ----- 
From: Stefan Santesson 
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked] 
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Santosh is correct.
 
Pointing to the location is not enough when using http. The filename must 
be specified.
RFC3280bis is made clearer on this point.
 
The reason is simple. Just pointing to the location may not be unambiguous 
since many crl files may reside there.
Then there is a practical one. We don?t want to put the burden on the cert 
validation logic to figure out what file is intended.
 
Stefan Santesson

From: Michael Lursen 
 
Stefan?

May be I am missing something.  Can you not simply invoke the HTTP and get 
the file?

 
If directory is a file that contains the CRL, it is fine. I assume that 
the file resides the filesystem root of the Web Server.

Hi Santosh

Does it mean that http://www.domain.com/directory/ is wrong, based on this 
RFC, even it points to a file?

BR 

Riho 

From: [email-masked] [mailto:[email-masked]] 
On Behalf Of Michael Lursen
Sent: Wednesday, February 08, 2006 8:36 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen 
 
Hi,
 
Can someone please tell me which of these URL?s is valid as a URL to a CRL 
Distribution point:

I think only url A is valid, according to the following line from RFC 
3280:
 
?If the cRLDistributionPoints extension contains a general name of type 
URI, the following semantics MUST be assumed: the URI is a pointer to the 
current CRL for the associated reasons and will be issued by the 
associated cRLIssuer.?
 
It is possible to use default document handling to forward URL B to a 
file. Should this type of URL be accepted?
 
Thanks in advance.
 
Kind regards,
Michaël Lürsen |

---

From: "Dave Engberg" <[email-masked]>
Date: Thu, 9 Feb 2006 14:52:14 -0500

Yup, it sure looks that way to me.

I'd certainly recommend trimming out most of that quoted section from
3280bis since it has an unnecessarily limited view of how a CRL stream could
be returned from a server via HTTP.  Plenty of implementors (e.g. US DoD)
dynamically serve out CRLs from a server-side application on an HTTP server
without appending the ".crl" suffix to the end of every URL.

The quoted section might make sense for ftp:// URLs, which are almost always
just static files, and which don't have the MIME type header information
separate from file name.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of santosh chokhani
Sent: Thursday, February 09, 2006 2:18 PM
To: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

David,

Your question is best answered by the editors of 3280.  I am simply trying
to ensure that I am reading 3280 correctly.  Am I?

-----Original Message-----
From: Dave Engberg [mailto:[email-masked]]
Sent: Thursday, February 09, 2006 1:25 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

Was there any technical reason for this?

I can't think of another use of HTTP that has a hard-coded URI suffix
requirement.  It would be like web browsers refusing to render HTML pages
unless they came from a URI ending in ".htm".  It seems that the canonical
HTTP type selection mechanism is the "content-type" header, not the
characters in the URI.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Santosh Chokhani
Sent: Thursday, February 09, 2006 1:03 PM
To: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Tom Gindin
Sent: Thursday, February 09, 2006 8:45 AM
To: Wen-Cheng Wang
Cc: [email-masked]
Subject: Re: [RFC 3280 ] valid URL syntax for CRL?

        RFC 4387 explicitly recommends URL's of approximately that format to
retrieve CRL's as well as certs, such as:  
http://www.some-ca.com/cgi-bin/get-crl?sHash=abcDEF1234567890 (although that
argument would actually be 27 characters long, with the trailing equal sign
from base 64 conversion omitted).
        This particular form is not ambiguous, and there seems no reason it
would not be used in a DP extension.
 
                Tom Gindin

        To:     <[email-masked]>
        cc: 

Wen-Cheng Wang
----- Original Message -----
From: Stefan Santesson
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked]
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Santosh is correct.
 
Pointing to the location is not enough when using http. The filename must be
specified.
RFC3280bis is made clearer on this point.

Stefan Santesson

From: Michael Lursen
 
Stefan?

 

If directory is a file that contains the CRL, it is fine. I assume that the
file resides the filesystem root of the Web Server.

Hi Santosh

BR 

Riho 

 
Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen 
 
Hi,

 

 
Thanks in advance.
 
Kind regards,
Michaël Lürsen |

---

From: "Price, Bill" <[email-masked]>
Date: Thu, 9 Feb 2006 14:36:40 -0500

The cited text seems to prescribe how the CRL must be stored on the
server. What is important is the format of the data that is put "on the
wire" by the server not how the server stores the data.  Specification
of the "application/pkix-crl MIME content-type" should be sufficient
specification of the wire format. The requirement that the URL name a
file seems excessive. Taken literally, the file requirement precludes
dynamic retrieval or generation of the CRL at the server in response to
the http-based CRL request. 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Santosh Chokhani
Sent: Thursday, February 09, 2006 1:03 PM
To: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

"When the HTTP or FTP scheme is specified, the
   URI MUST point to a CRL file.  The CRL file MUST contain a single
DER
   encoded CRL (indicated by the .crl file extension) as specified in
   [RFC 2585]."

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Tom Gindin
Sent: Thursday, February 09, 2006 8:45 AM
To: Wen-Cheng Wang
Cc: [email-masked]
Subject: Re: [RFC 3280 ] valid URL syntax for CRL?

        RFC 4387 explicitly recommends URL's of approximately that
format 
to retrieve CRL's as well as certs, such as:  
http://www.some-ca.com/cgi-bin/get-crl?sHash=abcDEF1234567890 (although

that argument would actually be 27 characters long, with the trailing 
equal sign from base 64 conversion omitted).
        This particular form is not ambiguous, and there seems no
reason 
it would not be used in a DP extension.
 
                Tom Gindin

        To:     <[email-masked]>
        cc: 

Can't it be a URL pointing to a CGI that return a CRL file (with
correct 
MIME type, of course)?
For example:
   http://www.some-ca.com/cgi-bin/get-crl.exe?partition=101
 
Wen-Cheng Wang
----- Original Message ----- 
From: Stefan Santesson 
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ;
[email-masked] 
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Santosh is correct.
 
Pointing to the location is not enough when using http. The filename
must 
be specified.
RFC3280bis is made clearer on this point.
 
The reason is simple. Just pointing to the location may not be
unambiguous 
since many crl files may reside there.
Then there is a practical one. We don?t want to put the burden on the
cert 
validation logic to figure out what file is intended.
 
Stefan Santesson

From: Michael Lursen 
Sent: den 8 februari 2006 16:34
To: Santosh Chokhani; Riho Raassild; [email-masked]; Stefan
Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
Stefan?

May be I am missing something.  Can you not simply invoke the HTTP and
get 
the file?

 

 
Hi Santosh

Does it mean that http://www.domain.com/directory/ is wrong, based on
this 
RFC, even it points to a file?

BR 

Riho 

From: [email-masked]
[mailto:[email-masked]] 
On Behalf Of Michael Lursen
Sent: Wednesday, February 08, 2006 8:36 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen 
 
Hi,
 
Can someone please tell me which of these URL?s is valid as a URL to a
CRL 
Distribution point:

 

URI, the following semantics MUST be assumed: the URI is a pointer to
the 
current CRL for the associated reasons and will be issued by the 
associated cRLIssuer.?

Thanks in advance.
 
Kind regards,
Michaël Lürsen |

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 10 Feb 2006 05:53:46 -0800

Tom,

I do not have any objection to your recommendation.

-----Original Message-----
From: Tom Gindin [mailto:[email-masked]] 
Sent: Friday, February 10, 2006 8:44 AM
To: Santosh Chokhani
Cc: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

        Santosh:

        In view of RFC 4387, I would think that that clause needs to be 
restricted to FTP.  For HTTP, IMHO the correct rule is simply that the URL 
MUST return a single DER encoded CRL, and that the conventions given in 
RFC 2585 section 3 should apply to file retrieval but do not prohibit the 
use of program interfaces instead.
        Of course, I'm not the editor of 3280-bis.

                Tom Gindin

"santosh chokhani" <[email-masked]>
Sent by: [email-masked]
02/09/2006 02:17 PM
 
        To:     <[email-masked]>
        cc: 

David,

-----Original Message-----
On

-----Original Message-----
On

that
argument would actually be 27 characters long, with the trailing equal 
sign

Tom Gindin

To:     <[email-masked]>
cc:

Wen-Cheng Wang
----- Original Message -----
From: Stefan Santesson
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked]
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

Santosh is correct.

be

Stefan Santesson

From: Michael Lursen

Stefan?

Hi Santosh

BR

Riho

Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen

Hi,

Thanks in advance.

Kind regards,
Michaël Lürsen |

#### smime.p7s has been removed from this note on February 10, 2006 by Tom 
Gindin

---

From: Tom Gindin <[email-masked]>
Date: Fri, 10 Feb 2006 08:44:05 -0500

Santosh:

                Tom Gindin

        To:     <[email-masked]>
        cc: 

David,

-----Original Message-----

Tom Gindin

To:     <[email-masked]>
cc:

Wen-Cheng Wang
----- Original Message -----
From: Stefan Santesson
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked]
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

Santosh is correct.

Stefan Santesson

From: Michael Lursen

Stefan?

Hi Santosh

BR

Riho

Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen

Hi,

Thanks in advance.

Kind regards,
Michaël Lürsen |