Re: cRLIssuer names and management domain correlation

[Stephen Kent <kent@xxxxxxx>]

Peter,

I would assume either the default case in which the CA must have signed the
CRL, or must have issued a cert (directly) to an entity who signed the CRL
and that cert should have the keyusage restriction extsnsion set to
indicate that the key in question is to be used only for CRL signing (and I
would mark this extension critical).  In either case, it then is apparent
that the entity signing the CRL has been authorized to do so by the CA who
issued the cert with the CDP extension.

Steve