Subject: 3280bis: CRL not issued by CA but for that CA only

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 14 Feb 2006 17:20:11 +0100

The case of the verification of a CRL issued by the CA is straightforward, even if not described nor detailed.

The case of an indirect CRL is covered, even if not described in detail.

The case of a CRL, issued by a CRL Issuer that is NOT the CA, and which contains revocation 
information for certificates issued only by that one CA, is not covered at all.

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Tue, 14 Feb 2006 09:46:45 -0800

I disagree with Denis.

Section 6.3 covers CRL issuer, whether it is certificate issuer or not.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: Tuesday, February 14, 2006 11:20 AM
To: pkix
Subject: 3280bis: CRL not issued by CA but for that CA only

The case of the verification of a CRL issued by the CA is
straightforward, even if not described nor detailed.

The case of a CRL, issued by a CRL Issuer that is NOT the CA, and which
contains revocation 
information for certificates issued only by that one CA, is not covered
at all.

Denis

---

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 14 Feb 2006 18:04:28 -0000

The last case is an indirect CRL.

   "If the scope of the CRL includes one or more certificates issued by
   an entity other than the CRL issuer, then it is an indirect CRL.  The
   scope of an indirect CRL may be limited to certificates issued by a
   single CA or may include certificates issued by multiple CAs.  If the
   issuer of the indirect CRL is a CA, then the scope of the indirect
   CRL MAY also include certificates issued by the issuer of the CRL."

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: den 14 februari 2006 08:20
To: pkix
Subject: 3280bis: CRL not issued by CA but for that CA only

Denis