[pkix] Re: Question in CRL Distribution Points field

              The CRL Distribution Point extension contains the LOCATION of the CRL, and if the extension is not present the relying party can only get the CRL from the issuer name directory entry.  Initially the directory name was the preferred form, but lots of experience indicates that it’s much less reliable to get attributes from directory names (because there’s no general way to find the directory for a given name) than to use a URL format – whether LDAP, FTP or HTTP.  Most certificates whose issuer wants revocation checking performed using CRL’s therefore include URL formats in the Distribution Point extension.

                             Tom Gindin
PS         These opinions are mine personally, and not necessarily those of my employer.
From: Tim Lake <[email protected]>
Sent: Monday, August 12, 2024 10:18 PM
To: [email protected]
Subject: [EXTERNAL] [pkix] Question in CRL Distribution Points field

Section 4. 2. 1. 13 of rfc5280 contains the following: If the distributionPoint field contains a directoryName, the entry for that directoryName contains the current CRL for the associated reasons and the CRL is issued by the associated cRLIssuer. 

Section 4.2.1.13 of rfc5280 contains the following:
If the distributionPoint field contains a directoryName, the entry for that directoryName contains the current CRL for the associated reasons and the CRL is issued by the associated cRLIssuer. The CRL may be stored in either the certificateRevocationList or authorityRevocationList attribute. The CRL is to be obtained by the application from whatever directory server is locally configured. The protocol the application uses to access the directory (e.g., DAP or LDAP) is a local matter.

And I found a sample in the CRL Distribution Points field of the certificate:
[1]CRL Distribution Point
Distribution Point Name:
  Full Name:
    Directory Address:
      CN=CRL71
      CN=Posta CA 1
      CN=AIA
      CN=Public Key Services
      CN=Services
      CN=Configuration
      DC=ca
      DC=posta
      DC=rs
[2]CRL Distribution Point
  Distribution Point Name:
    Full Name:
      URL=ldap://ldap.ca.posta.rs/cn=Posta<http://ldap.ca.posta.rs/cn=Posta> CA 1,cn=AIA,cn=Public Key Services,cn=Services,cn=Configuration,dc=ca,dc=posta,dc=rs?certificateRevocationList;binary (ldap://ldap.ca.posta.rs/cn=Posta%20CA%201,cn=AIA,cn=Public%20Key%20Services,cn=Services,cn=Configuration,dc=ca,dc=posta,dc=rs?certificateRevocationList%3Bbinary<http://ldap.ca.posta.rs/cn=Posta%20CA%201,cn=AIA,cn=Public%20Key%20Services,cn=Services,cn=Configuration,dc=ca,dc=posta,dc=rs?certificateRevocationList%3Bbinary>)
      URL=http://sertifikati.ca.posta.rs/crl/PostaCA1.crl<http://sertifikati.ca.posta.rs/crl/PostaCA1.crl>

How should I understand the content in  [1]CRL Distribution Point ?I mean, I always thought that the CRL Distribution Points field provided the download URL of the CRL, but now it provides a DirectoryName.So this confuses me.

If anyone can help me out, I'd be very grateful.

_______________________________________________
pkix mailing list -- [email protected]
To unsubscribe send an email to [email protected]