RE: CA Rekey and CRL Validation

["Carl Wallace" <cwallace@xxxxxxxxxxxx>]

> You are correct that absence of IDP does not necessarily mean 
> that it is a CRL is complete for the CA.  It means more.  
> Absence of IDP means the CRL is complete for all certificates 
> issued by all CAs that identify the CRL issuer in their 
> public key certificates (including certificates issued by the 
> CRL issuer).  See X.509: "it is the responsibility of the CRL 
> issuer to ensure that the CRL is complete in that it contains 
> all revocation entries...from all authorities that identify 
> this CRL issuer in their certificates."  
 
Ack.  Without an IDP, the CRL can't be indirect.  I was still stuck in the
missing DP field mindset of a few days ago.  Kindly ignore my post:-)