RE: CDP in self signed root CA

["Santosh Chokhani" <chokhani@xxxxxxxxxxxx>]

Title: Message

Hi Erwan:

 

I assume that the root CA certificate is the self-signed trust anchor.  In that case, it should NOT be part of the certificates in the chain for path validation anyway.  Thus, you do not need CDP in it and you should not verify it and run it through the 3280 path validation state machine.

 

-----Original Message-----
From: owner-ietf-pkix@xxxxxxxxxxxx [mailto:owner-ietf-pkix@xxxxxxxxxxxx] On Behalf Of Erwan Smits
Sent: Thursday, December 05, 2002 11:36 AM
To: ietf-pkix@xxxxxxx
Subject: CDP in self signed root CA

We are building a certificate hierarchy with 4 (CA) layers. We want to include a CDP extension in every CA and end user certificate. At the moment we have a discussion about the need for a CDP extension in the Root CA. The argument against it is that it doesn't make sense because there is no supperior CA that can sign the CRL. The argument for a CDP is that for performing a correct path validation the CRL for every CA (including the Root CA) and end-user certificate should be validated.

 

I scanned through RFC 3280, but it doesn't say anything about it. Does anybody have suggestions?

 

Greetings,

 

Erwan Smits