Subject: cert == crl

From: Pavel Krylov <[email-masked]>
Date: Wed, 08 Dec 1999 20:18:23 +0300

Hi all,

I would be grateful if someone helped me with one case in CRL
processing.
A certificate has some information how to find appropriate CRLs
to check revokation status of the certificate. This information includes
certificate issuer name (DN), alternative issuer name (GN) and CRLDPs
extension, which in its order includes distribution point (dp, i.e. 
a choice between fullName(GN) and nameRelativeToCRLIssuer (rdn) ),
reason codes and cRLIssuer name (GN).

Okay, how I understand CRL processing begins from certificate, i.e.
getting proper information to find appropriate CRL. Suppose, we have
a certificate with following fields ( only mentioned to CRL ):
        
        cert
         |_ issuer (DN)
         |_ altIssuer (GN)
         |_ certExtensions
            |_ CRLDPs extension
               |_ crldp
                  |_ cRLIssuer (GN)

i.e. dp is absent, but cRLIssuer is present in CRLDPs extension.
In this case I have a name of issuer of needed CRL, but it is 
represented by GN type. Say, I have some CRLs to try to apply them
for the certificate. But each CRL has issuer (DN) and altIssuer (GN).
So my question is how cRLIssuer(GN) is supposed to be compared with
crl.issuer(DN) and crl.altIssuer(GN)??

Any ideas?

Thanks a lot.

Pavel Krylov

---

From: Russ Housley <[email-masked]>
Date: Wed, 08 Dec 1999 16:19:29 -0500

If the CRLIssuer GN is a DirectoryName, then the CRL can be found in the 
LDAP or X.500 Directory.  I think that all of the other cases are ambiguious.

Russ

---

From: Pavel Krylov <[email-masked]>
Date: Tue, 14 Dec 1999 13:31:29 +0300

Thank you Russ for your reply. Okay, I understood the case I had
written.
Could you answer me the same question, if certificate's CRLDP extension
had Distribution Point in it and crlIssuer in the same time. What 
restrictions are applied to the crlIssuer?

Thanks a lot.

Pavel

---

From: "Tom Biskupic" <[email-masked]>
Date: Tue, 14 Dec 1999 12:27:33 -0000

Pavel, Russ,

If I understand this correctly, the Location where the CRL can be obtained
is either determined by the DP or if the DP is absent by the CRL Issuer
Name.

In the same way that you can have a DP Name that is a URI or an email
address etc couldn't the CRL Issuer name also be a URI? I know it's a bit of
a strange case but imagine the CRL Issuer certificate had no subject but
only a subject alternative name.

In terms of Pavel's question - if both DP and issuer are specified aren't
they both quite independant? ie the location of the CRL could be quite
different to what is implied by the CRL Issuer name(s).

Tom Biskupic

> -----Original Message-----
> From: Pavel Krylov [mailto:[email-masked]]
> Sent: Tuesday, December 14, 1999 10:31 AM
> Cc: [email-masked]
> Subject: Re: cert == crl
>
>
>

---

From: Pavel Krylov <[email-masked]>
Date: Tue, 14 Dec 1999 15:47:53 +0300

Hi Tom,
may be I wrote my questions not clearly ( sorry for that ), but my 
misunderstanding lies not in obtaining of a proper CRL by CRLDPs 
certificate extension. It lies when I've obtained some CRLs by
crl distribution point ( pointed in CRLDPs certificate extension )
and I need to choose appropriate CRLs from that amount. One of 
necessary tests is to check that crl.issuer matches with the cRLIssuer
( which is in CRLDPs extension ). How I noticed in my previous letters,
crl.issuer is DN, but cRLIssuer is GN, so I'm trying to discover all
limitations on their comparing. Hope, I make my problem clear.

Pavel.

---

From: "Tom Biskupic" <[email-masked]>
Date: Tue, 14 Dec 1999 16:04:15 -0000

Pavel,

If you take the assumption that CRLs from only one issuer are placed in a
given DP then could you just compare the DP in the CDP with the DP in the
IDP (or CRLScope Extension) of the CRL?

This seems kinda naive to me but will it work? Does it make sense/is it
valid for multiple issuers to place CRLs in the same DP?

Tom Biskupic

> Sent: Tuesday, December 14, 1999 12:48 PM
> To: Tom Biskupic
> Cc: [email-masked]
> Subject: Re: cert == crl
>
>
>
> Hi Tom,

---

From: Pavel Krylov <[email-masked]>
Date: Tue, 14 Dec 1999 19:26:25 +0300

Hi again,
please look in message body

> IDP (or CRLScope Extension) of the CRL?

Please, Tom, I don't understand the relations between your question and
mine.
You are talking about comparing of DP in CDP and IDP. That is not a
problem,
I suppose. FPDAM claims only one rule of it - at least one part of DP in
IDP ( if it's present ) must match with a part of DP in CDP. But my 
questions is how I need ( what are the rules ) to compare DN and GN in
CRL case? ( please, look at my previous message ).

> valid for multiple issuers to place CRLs in the same DP?

Sorry, but that is not my question. Tom, if you have more questions, may
be
it would be better to move them into private messages, what do you
think?

Pavel.