Subject: [pkix] AuthKeyId and CrlEntryExtension.CertificateIssuer

From: Martin Rex <[email-masked]>
Date: Sat, 21 Jan 2012 04:04:21 +0100 (MET)

If a PKI CA wanted to re-use CA DNames when rolling CA keys, and in
combination with indirect CRLs, how/where would the AuthorityKeyIdentifier
for the CRLEntryExtension.CertificateIssuer be conveyed, that would
be necessary to disambiguate between CA certs with different keys and
exact same SubjectName?

I seem to have difficulties locating an answer in ITU-T X.509 and rfc5280.

-Martin

---

From: Russ Housley <[email-masked]>
Date: Sat, 21 Jan 2012 16:50:35 -0500

> I seem to have difficulties locating an answer in ITU-T X.509 and rfc5280.

Does Section 4.4 of RFC 4210 provide an answer?  It has been a while since I looked at it, but I seem to remember it being very complete.

Russ