RE: Dedicated CRL signing keys

["Housley, Russ" <rhousley@xxxxxxxxxxxxxxx>]

Santosh:

> Optional is
> sufficient.  It should NOT be mandatory to have separate signing
> keys for certificates and CRLs. 
> Thanks.  I think we agree. 

If CAs issue CRLs, then the CA can sign certificates and CRLs with the
same key, or the CA can use separate keys.

Certificate-using applications must be able to handle certificates and
CRLs signed by the same key.  Certificate-using applications may
handle CRLs signed by a different key than the certificates.

If you agree with this position, then we agree.

Russ