RE: Cached OCSP responses vs. single entry CRLs

["Santosh Chokhani" <chokhani@xxxxxxxxxxxx>]

Michael:

The standard requires the IDP to be critical and not the CRLDP.  If a client
does not process CRLDP, it will have to rely on a CRL.

-----Original Message-----
From: owner-ietf-pkix@xxxxxxxxxxxx [mailto:owner-ietf-pkix@xxxxxxxxxxxx] On
Behalf Of Michael Ströder
Sent: Wednesday, December 10, 2003 11:15 AM
To: Jean-Marc Desperrier
Cc: ietf-pkix@xxxxxxx
Subject: Re: Cached OCSP responses vs. single entry CRLs



Jean-Marc Desperrier wrote:
> 
> I'm a bit sceptic it really works,

So am I.

> but if the CRL's IDP is marked
> critical as it should, maybe a good number of client will duly reject 
> the CRL when they can not support that case.

I saw at least one widely-deployed software of a major vendor simply crash 
when CRL IDP was marked critical.

Ciao, Michael.