Re: Signer certificate discovery for CRLs

[Russ Housley <housley@xxxxxxxxxxxx>]

Denis:

> If I understand you correctly, for whatever reason (which one ?), you only 
> want to use HTTP. Then I would think the solution would be to use the 
> following draft: draft-ietf-pkix-certstore-http-08 and make sure that it 
> will be usable with the current AIA and SIA extensions to fetch CRL 
> issuers certificates.

RFC 3280 specifies the inclusion of AIA and SIA in certificates.  It is not 
specified for the inclusion in CRLs.  I believe that the proposal is to 
write a specification for using AIA in CRLs.

The problem has been stated, and a proposed solution has been stated.  If 
you do not think the problem really exists, please explain why this is the 
case.  If you have another way to solve the stated problem, please share it.

Russ