Re: X.509, PKIX, and pathLenConstraint

[Stephen Kent <kent@xxxxxxx>]

David,

To me, the text you cite (7.3) lends further credence to the notion 
that a CA is the entity that signs CRLs. Only the CA that issued a 
cert could sign a CRL revoking that cert, until v3 of X.509, where 
the introduction of indirect CRLs and CRL DPs opened up new 
possibilities. The fundamental question is whether these features 
create a new class of entity that can sign CRLs but not be marked (in 
its certificate) as a CA, or whether these facilities merely allow 
one CA to delegate CRL signing to another CA, perhaps operated under 
the same administrative jurisdiction.

Steve