Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 8 Feb 2006 17:39:03 -0000

Santosh is correct.

Pointing to the location is not enough when using http. The filename must be specified.

RFC3280bis is made clearer on this point.

The reason is simple. Just pointing to the location may not be unambiguous since many crl files may reside there.

Then there is a practical one. We don't want to put the burden on the cert validation logic to figure out what file is intended.

Stefan Santesson

Program Manager, Standards Liaison

Windows Security

________________________________

From: Michael Lursen 
Sent: den 8 februari 2006 16:34
To: Santosh Chokhani; Riho Raassild; [email-masked]; Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Stefan?

________________________________

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 4:33 PM
To: Michael Lursen; Riho Raassild; [email-masked]
Cc: Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

May be I am missing something.  Can you not simply invoke the HTTP and get the file?

________________________________

From: Michael Lursen [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 10:23 AM
To: Santosh Chokhani; Riho Raassild; [email-masked]
Cc: Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

So you are saying that we must accept this type of URL?

________________________________

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 4:25 PM
To: Riho Raassild; Michael Lursen; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

If directory is a file that contains the CRL, it is fine. I assume that the file resides the filesystem root of the Web Server.

________________________________

From: Riho Raassild [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 10:15 AM
To: Santosh Chokhani; Michael Lursen; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Hi Santosh

Does it mean that http://www.domain.com/directory/ is wrong, based on this RFC, even it points to a file?

BR 

Riho 

________________________________

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Wednesday, February 08, 2006 5:18 PM
To: Michael Lursen; [email-masked]
Cc: Riho Raassild
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

I agree that option A pointing to the file is the correct one.

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of Michael Lursen
Sent: Wednesday, February 08, 2006 8:36 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Hi,

Can someone please follow up on this email? 

Thanks,

Michaël Lürsen.

________________________________

From: Michael Lursen 
Sent: Monday, January 30, 2006 10:14 AM
To: [email-masked]'
Cc: Edwin Burgstede; [email-masked]'
Subject: [RFC 3280 ] valid URL syntax for CRL? 

Hi,

Can someone please tell me which of these URL's is valid as a URL to a CRL Distribution point:

A.)    http://www.domain.com/directory/list.crl

B.)    http://www.domain.com/directory/

I think only url A is valid, according to the following line from RFC 3280:

"If the cRLDistributionPoints extension contains a general name of type URI, the following semantics MUST be assumed: the URI is a pointer to the current CRL for the associated reasons and will be issued by the associated cRLIssuer."

It is possible to use default document handling to forward URL B to a file. Should this type of URL be accepted?

Thanks in advance.

Kind regards,

Michaël Lürsen |

PS, please use reply all.

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Thu, 9 Feb 2006 10:08:35 +0800

Can't it be a URL pointing to a CGI that return a CRL file (with correct MIME type, of course)?
For example:
   http://www.some-ca.com/cgi-bin/get-crl.exe?partition=101

Wen-Cheng Wang
  ----- Original Message ----- 
  From: Stefan Santesson 
  To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked] 
  Sent: Thursday, February 09, 2006 1:39 AM
  Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

  Santosh is correct.

  Stefan Santesson

  Windows Security

------------------------------------------------------------------------------

  From: Michael Lursen 

  Stefan?

------------------------------------------------------------------------------

------------------------------------------------------------------------------

------------------------------------------------------------------------------

------------------------------------------------------------------------------

  Hi Santosh

   

  BR 

  Riho 

------------------------------------------------------------------------------

------------------------------------------------------------------------------

  Hi,

  Thanks,

  Michaël Lürsen.

------------------------------------------------------------------------------

  From: Michael Lursen 

  Hi,

  Thanks in advance.

  Kind regards,

  Michaël Lürsen |

---

From: Tom Gindin <[email-masked]>
Date: Thu, 9 Feb 2006 08:45:22 -0500

RFC 4387 explicitly recommends URL's of approximately that format 
to retrieve CRL's as well as certs, such as:  
http://www.some-ca.com/cgi-bin/get-crl?sHash=abcDEF1234567890 (although 
that argument would actually be 27 characters long, with the trailing 
equal sign from base 64 conversion omitted).
        This particular form is not ambiguous, and there seems no reason 
it would not be used in a DP extension.
 
                Tom Gindin

"Wen-Cheng Wang" <[email-masked]>
Sent by: [email-masked]
02/08/2006 09:08 PM
 
        To:     <[email-masked]>
        cc: 
        Subject:        Re: [RFC 3280 ] valid URL syntax for CRL?

Can't it be a URL pointing to a CGI that return a CRL file (with correct 
MIME type, of course)?
For example:
   http://www.some-ca.com/cgi-bin/get-crl.exe?partition=101
 
Wen-Cheng Wang
----- Original Message ----- 
From: Stefan Santesson 
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked] 
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Santosh is correct.
 
Pointing to the location is not enough when using http. The filename must 
be specified.
RFC3280bis is made clearer on this point.
 
The reason is simple. Just pointing to the location may not be unambiguous 
since many crl files may reside there.
Then there is a practical one. We don?t want to put the burden on the cert 
validation logic to figure out what file is intended.
 
Stefan Santesson

From: Michael Lursen 
 
Stefan?

May be I am missing something.  Can you not simply invoke the HTTP and get 
the file?

 
If directory is a file that contains the CRL, it is fine. I assume that 
the file resides the filesystem root of the Web Server.

Hi Santosh

Does it mean that http://www.domain.com/directory/ is wrong, based on this 
RFC, even it points to a file?

BR 

Riho 

From: [email-masked] [mailto:[email-masked]] 
On Behalf Of Michael Lursen
Sent: Wednesday, February 08, 2006 8:36 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen 
 
Hi,
 
Can someone please tell me which of these URL?s is valid as a URL to a CRL 
Distribution point:

I think only url A is valid, according to the following line from RFC 
3280:
 
?If the cRLDistributionPoints extension contains a general name of type 
URI, the following semantics MUST be assumed: the URI is a pointer to the 
current CRL for the associated reasons and will be issued by the 
associated cRLIssuer.?
 
It is possible to use default document handling to forward URL B to a 
file. Should this type of URL be accepted?
 
Thanks in advance.
 
Kind regards,
Michaël Lürsen |