Re: Separate CRL Issuance Entity Was: RE: Open Issue in Part1:path l ength constraints

[Stephen Kent <kent@xxxxxxx>]

Dave,

> I would like to consider including the option to have an entity 
> other than a "cert issuing  authority" to sign CRLs. In cases where 
> a Root CA needs to issue certificates infrequently (such as we have 
> at Identrus), but needs to issue CRLs much more frequently, there 
> seems to be a case to have different certificates for these 
> purposes. I don't want to rule out having this option. If we define 
> that having the CA bit set means the capability to issue 
> certificates, this CRL signing entity should not have that bit set. 
> Is it specifically stated somewhere that the assertion of the CA bit 
> is defined as certificate issuance capability? My old X.509 (97) 
> defines a CA as: An authority trusted by one or more users to create 
> and assign certificates. 2459 doesn't provide any more help.

If one uses the KeyUsage extension and marks it critical, then there 
is a separate flag re cert signing (KeyCertSign). But, the current 
spec, has other constraints that don't allow for the CRLSign bit to 
be set and the CA flag in BasicConstraints to not be set, so we have 
a mixed bag of options now.

Steve