Re: Use case of nameRelativeToCRLIssuer

X.509 (2012) says:

 The nameRelativeToCRLIssuer  component can be used only if the CRL distribution point is assigned a
distinguished name that is directly subordinate to the distinguished name of the CRL issuer. In this case, the
nameRelativeToCRLIssuer  component conveys the relative distinguished name with respect to the CRL issuer
distinguished name.

Basically to get the DN where you can find the CRL, you combine the CRL issuer’s DN and append the nameRelativeToCRLIssuer. The point is to search the Directory for that full DN to get the associated certificateRevocationList (2.5.4.39) attribute (Clause 11.2.4 of X.509).

Does anyone implement this in practice? Maybe, with LDAP. Someone posted to Server Fault asking for this exact thing, although they didn’t say it was to be used with LDAP: <http://serverfault.com/questions/764667/how-to-add-namerelativetocrlissuer-to-crl-using-openssl>.

Sean

> On Jul 20, 2016, at 11:28 PM, Security Developer <[email protected]> wrote:
> 
> Dear All,
> 
> CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
> 
>    DistributionPoint ::= SEQUENCE {
>         distributionPoint       [0]     DistributionPointName OPTIONAL,
>         reasons                 [1]     ReasonFlags OPTIONAL,
>         cRLIssuer               [2]     GeneralNames OPTIONAL }
> 
>    DistributionPointName ::= CHOICE {
>         fullName                [0]     GeneralNames,
>         nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }
> 
> Could any body please explain the use case when nameRelativeToCRLIssuer should be used? Thanks

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix