Subject: Storage of ARLs in directory

From: Sean Mullan <[email-masked]>
Date: Wed, 29 Sep 1999 11:00:50 -0400

RFC2587 (LDAPv2 Schema) notes that "the authorityRevocationList
attribute, if present in a particular CA's entry, includes 
revocation information regarding certificates issued to other CAs."

However, just above that it notes that "The certificateRevocationList
attribute, if present in a particular CA's entry, contains CRL(s)
as defined in RFC 2459."

CRLs as defined in RFC 2459 can be created to contain only
revocation information regarding certificates issued to other CAs.
Does this imply that a CA MAY then choose to store an ARL in
either the authorityRevocationList attribute or the 
certificateRevocationList attribute? 

Furthermore, how does a client know which attribute the CA 
stored the ARL in? Must it check both attributes to be sure?

Thanks for any clarification.
--Sean