Subject: RE: Certs in CRLs - New standards task?

From: "Carl Wallace" <[email-masked]>
Date: Thu, 14 Sep 2006 12:07:38 -0700

> One CRL with a non-critical extension with certs would work for all. 

How?  Would it be populated with multiple paths to account for
cross-certified environments?

---

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 14 Sep 2006 22:19:40 +0100

My way of looking at this is that a CA MAY provide a bag of certs in a
CRL. Typically it would only be none or 1 certificate for the CRL Issuer
issued by a CA from the validated path, but in theory you could provide
as many certs and paths as you want.

That is purely an implementation performance choice given the community
f RPs you serve. But there is no reason I can see why a CA should have
to produce multiple versions of a CRL because of this feature.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

> -----Original Message-----
> From: Carl Wallace [mailto:[email-masked]]
> Sent: den 14 september 2006 12:08
> To: Stefan Santesson
> Cc: [email-masked]
> Subject: RE: Certs in CRLs - New standards task?
>