RE: cA flag and CRL issuers (was Re: Last Call: draft-ietf-pkix-new-part1-06.txt comments)

["Carlin Covey" <ccovey@xxxxxxxxxx>]

Denis said:

"In an open architecture where clients do not know where to fetch the
revocation information unless using "out-of-bands" means, if a CA wants to
revoke the authorities in charge of revocation status information (i.e. CRL
Issuers or OCSP responders) they is no other way than using directly the
issuing CA key."

[Carlin]: I agree.  But now that the CRL Issuer's or OCSP responder's
certificate has been revoked, what do the Relying Parties do?  It seems
that they should now look for a CRL issued by the CA, but I haven't found
any document that mandates this behavior on the part of the Relying Parties.