Subject: RE: Huge CRLs

From: "Salter, Thomas A" <[email-masked]>
Date: Thu, 9 Sep 1999 15:37:32 -0400

See RFC 2459, sec. 3.3:
   An entry is added to the CRL as part of the next update
   following notification of revocation. An entry may be removed from
   the CRL after appearing on one regularly scheduled CRL issued beyond
   the revoked certificate's validity period.

 > -----Original Message-----
 > From: Martin Lindström [mailto:[email-masked]]
 > Sent: Thursday, September 09, 1999 10:53 AM
 > To: [email-masked]; [email-masked]
 > Cc: [email-masked]; [email-masked]; [email-masked];
 > [email-masked]
 > Subject: Huge CRLs
 > 
 > 
 > 
 > I have been searching the PKIX RFCs and X.509 standard for
 > a text that mandates something like:
 > "A certificate that has revoked should only have an entry in a
 >  CRL as long as its validity period indicates that it has not
 >  expired"
 > ...but I haven't been able to find it.
 > 
 > Given the problem with CRL scalability, things get even worse
 > if some CAs issue CRLs with entries that point at already invalid
 > certificates. If a system needs the possibility to verify 
 > certificates
 > back in time, shouldn't the CRLs be archived instead of getting
 > larger and larger?
 > 
 > Comments?
 > 
 > /Martin Lindström
 > 
 > ______________________________________
 >          Entegrity Solutions
 > 
 >   Martin Lindström
 >   Systems Designer 
 > 
 >   Finlandsgatan 60 
 >   S-164 74 Kista, Sweden
 >   Direct: +46-(0)8-477-7735
 >   Fax:    +46-(0)8-477-7731
 >   Cell:   +46-(0)70-483-0024
 > ______________________________________
 >