RE: Dedicated CRL signing keys

["Housley, Russ" <rhousley@xxxxxxxxxxxxxxx>]

Yes.  So, I guess we agree.

At 04:47 PM 4/26/2001 -0400, Santosh Chokhani wrote:
> Russ:
> Will a CA that signs the certificates and CRLs using different keys, but
> same Issuer DN be considered compliant?  If yes, then we
> agree.
>  
> -----Original
> Message-----
> From: Housley, Russ
> [mailto:rhousley@xxxxxxxxxxxxxxx]
> Sent: Thursday, April 26, 2001 4:36 PM
> To: Santosh Chokhani
> Cc: ietf-pkix@xxxxxxx
> Subject: RE: Dedicated CRL signing keys
>
> Santosh:
>
> > Optional is
> > sufficient.  It should NOT be mandatory to have separate signing
> > keys for certificates and CRLs. 
> > Thanks.  I think we agree. 
>
> If CAs issue CRLs, then the CA can sign certificates and CRLs with the
> same key, or the CA can use separate keys.
>
> Certificate-using applications must be able to handle certificates and
> CRLs signed by the same key.  Certificate-using applications may
> handle CRLs signed by a different key than the certificates.
>
> If you agree with this position, then we agree.
>
> Russ