Re: Current status of CRL validation ?

["Julien Stern" <julien.stern@xxxxxxxxxxxxx>]

Santosh,

thank again for your quick reply.

Two more little questions, and I'll (probably) stop bothering :)

1) According to what you said, a certificate could at the same time
be revoked or not revoked depending on your local policy (more
specifically depending on the path you choose) ? That seems pretty
weird... or did I misunderstood something ?

2) When I download a CRL, can I check it's signature by verifying the
path only ONCE ? Or do I have to do it each time I want to check a
certificate ? If say, two S/MIME clients, send me two certificates whose
revocation information are found in the same CRL, but with different
paths going to different trusted anchors, it seems to me that I have
to rebuild and recheck the path for the CRL each time ?

--
Julien