[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
CRLs' cycle
Hi all,
I didn't find any limitations for CRL infrastructure .. I found out
one interesting CRL configuration, when revokation only one certificate
in it follows to automatic revokation all certificates, those in
the cycle. Basically it seems like:
CA1
|
V
cert_1 -~-~-~-~-~-> crl_2
| &
| |
| |
V |
crl_1 <-~-~-~-~-~- cert_2 <----- CA2
-~-~-~ line shows who references to a crl.
------ line shows who issued a crl.
When no one certificate is revoked in the infrastructure, then
it looks good and works best ( I think ). But if only one certificate
is revoked by appropriate crl, then it follows to the automatic
revokation of another certificate ( in this example ).
So my question: is this infrastructure illicit by rfc2459 or not?
Another question: have I missed something?
Thanks a lot.
Pavel.