[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Cached OCSP responses vs. single entry CRLs
Ryan M. Hurst wrote:
[...] there is not way to tell from a CDP if the
data on the other end represents a partitioned CRL or a full one.
But then clean client should check the content of the IDP extension
after getting the CRL and check it's distribution point matches the
distribution field of the CDP, and if not refuse the CRL, and supposedly
try the next crldp inside the cert.
RFC3280 6.3.3 (b)(2)(i)
I'm a bit sceptic it really works, but if the CRL's IDP is marked
critical as it should, maybe a good number of client will duly reject
the CRL when they can not support that case.