Re: Dedicated CRL signing keys

["David P. Kemp" <dpkemp@xxxxxxxxxxxxxx>]

If certificate-using applications MAY handle CRLs signed by a different key
than the certificates, then CAs have no real ability to exercise that option.

I believe:

Certificate-using applications SHOULD handle CRLs signed by a different key
than the certificates.

Dave



"Housley, Russ" wrote:
> Yes.  So, I guess we agree.
> 
> At 04:47 PM 4/26/2001 -0400, Santosh Chokhani wrote:
> > Russ: Will a CA that signs the certificates and CRLs using different keys,
> > but same Issuer DN be considered compliant?  If yes, then we agree.
> >
> > From: Housley, Russ [mailto:rhousley@xxxxxxxxxxxxxxx]
> > > Certificate-using applications must be able to handle certificates and CRLs
> > > signed by the same key.  Certificate-using applications may handle CRLs
> > > signed by a different key than the certificates.
> > >
> > > If you agree with this position, then we agree.
> > >
> > > Russ