[pkix] Re: RFC5280 "Freshest CRL" Duplication - erratum ?
Russ Housley <[email protected]> Wed, 28 Jan 2026 10:56:58 -0500
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Message-ID | <[email protected]> |
--===============4646535926051717774== Content-Type: multipart/alternative; boundary="Apple-Mail=_BD8F2A79-407C-4312-ACBC-8C7CB79819E2" --Apple-Mail=_BD8F2A79-407C-4312-ACBC-8C7CB79819E2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Delta CRLs are an OPTIONAL feature. Delta CRLs have not ben widely = deployed by CAs. However, if the CA chooses to use delta CRLs, I would = expect both the full CRL and the certificate to include the Freshest CRL = extension. Russ > On Jan 8, 2026, at 8:40=E2=80=AFPM, Sean Williams = <[email protected]> wrote: >=20 > Hey folks, >=20 > My org is deploying a new CA service issuing certs for clients in a = polyglot OS/language ecosystem. While enabling online revocation via = CRL, we discovered that clients on another OS weren't polling for delta = CRLs from the CA. Base CRL distribution/ingestion as described in = section 4.2.1.13 et al still work as expected. >=20 > Our previously-operated CA service (we'll call this "CA Service A") = supports publishing delta CRLs, and these were indeed getting consumed = by the OS. The new CA service ("CA Service B") does as well, but clients = aren't picking it up. >=20 > After some deep dives, we discovered an incompatibility between = vendors - likely fueled by differing interpretations of RFC5280: > CA Service A uses the Freshest CRL extension in the CRL itself, = described in section 5.2.6 of RFC 5280. > CA Service B uses the Freshest CRL extension on certificates the CA = issues, described in section 4.2.1.15 of RFC 5280. >=20 > In our tests, the OS only parses the CRL's extension (5.2.6), not the = certificate's.=20 >=20 > Both of these services seem to be in the right. The extension is = labeled optional (in both places) in the RFC. Both services are = consuming/expecting the same data, labeled with the same OID - they're = just doing so from two different locations. The spec describes the = similarity in data format between the two extensions, but leaves the = actual data contract between them (and issuers+verifiers as executors of = that contract) undefined.=20 >=20 > CA Service A and the OS in question are more tightly integrated, but = reasonable interpretations of the spec would suggest this should "just = work" between conformant CAs/online verifiers. >=20 > I'm not sure if this would fall under technical errata or not - wanted = to open a line of dialogue to understand architectural intent and so on. >=20 > Cheers! > --Sean W. > _______________________________________________ > pkix mailing list -- [email protected] <mailto:[email protected]> > To unsubscribe send an email to [email protected] = <mailto:[email protected]> --Apple-Mail=_BD8F2A79-407C-4312-ACBC-8C7CB79819E2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" = content=3D"text/html; charset=3Dutf-8"></head><body = style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; = line-break: after-white-space;">Delta CRLs are an OPTIONAL feature. = Delta CRLs have not ben widely deployed by CAs. However, if = the CA chooses to use delta CRLs, I would expect both the full CRL and = the certificate to include the Freshest CRL = extension.<div><br></div><div>Russ<br = id=3D"lineBreakAtBeginningOfMessage"><div><br><blockquote = type=3D"cite"><div>On Jan 8, 2026, at 8:40=E2=80=AFPM, Sean Williams = <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><meta charset=3D"UTF-8"><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;">Hey folks,</div><div class=3D"elementToProof" style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;"><br></div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;">My org is deploying a new CA service issuing certs for clients in = a polyglot OS/language ecosystem. While enabling online revocation via = CRL, we discovered that clients on another OS weren't polling for delta = CRLs from the CA. Base CRL distribution/ingestion as described in = section 4.2.1.13 et al still work as expected.</div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;"><br></div><div class=3D"elementToProof" style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;">Our previously-operated CA = service (we'll call this "CA Service A") supports publishing delta CRLs, = and these were indeed getting consumed by the OS. The new CA service = ("CA Service B") does as well, but clients aren't picking it = up.</div><div class=3D"elementToProof" style=3D"font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;"><br></div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;">After some deep dives, we discovered an incompatibility between = vendors - likely fueled by differing interpretations of = RFC5280:</div><ul = data-editing-info=3D"{"applyListStyleFromLevel":false,"unor= deredStyleType":1}" style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = margin-top: 0px; margin-bottom: 0px; list-style-type: disc;"><li = style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt;"><div = role=3D"presentation" class=3D"elementToProof">CA Service A uses the = Freshest CRL extension in the CRL itself, described in section 5.2.6 of = RFC 5280.</div></li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;"><div role=3D"presentation" class=3D"elementToProof">CA Service B = uses the Freshest CRL extension on certificates the CA issues, described = in section 4.2.1.15 of RFC 5280.</div></li></ul><div style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;"><br></div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;">In our tests, the OS only parses the CRL's extension (5.2.6), not = the certificate's. </div><div class=3D"elementToProof" = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;"><br></div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;">Both of these services seem to be in the right. The extension is = labeled optional (in both places) in the RFC. Both services are = consuming/expecting the same data, labeled with the same OID - they're = just doing so from two different locations. The spec describes the = similarity in data format between the two extensions, but leaves the = actual data contract between them (and issuers+verifiers as executors of = that contract) undefined. </div><div class=3D"elementToProof" = style=3D"font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;"><br></div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;">CA Service A and the OS in question are more tightly integrated, = but reasonable interpretations of the spec would suggest this should = "just work" between conformant CAs/online verifiers.</div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;"><br></div><div class=3D"elementToProof" style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;">I'm not sure if this would fall = under technical errata or not - wanted to open a line of dialogue to = understand architectural intent and so on.</div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;"><br></div><div class=3D"elementToProof" style=3D"font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid; = font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, = Helvetica, sans-serif; font-size: 12pt;">Cheers!</div><div = class=3D"elementToProof" style=3D"font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; orphans: 2; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration-line: none; text-decoration-thickness: auto; = text-decoration-style: solid; font-family: Aptos, Aptos_EmbeddedFont, = Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: = 12pt;">--Sean W.</div><span style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = orphans: 2; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline = !important;">_______________________________________________</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">pkix mailing list --<span = class=3D"Apple-converted-space"> </span></span><a = href=3D"mailto:[email protected]" style=3D"font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: 0px;">[email protected]</a><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration-line: none; = text-decoration-thickness: auto; text-decoration-style: solid;"><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;">To unsubscribe send an email to<span = class=3D"Apple-converted-space"> </span></span><a = href=3D"mailto:[email protected]" style=3D"font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; widows: 2; = word-spacing: 0px; -webkit-text-stroke-width: = 0px;">[email protected]</a></div></blockquote></div><br></div></body></h= tml>= --Apple-Mail=_BD8F2A79-407C-4312-ACBC-8C7CB79819E2-- --===============4646535926051717774== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KcGtpeCBtYWls aW5nIGxpc3QgLS0gcGtpeEBpZXRmLm9yZwpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRv IHBraXgtbGVhdmVAaWV0Zi5vcmcK --===============4646535926051717774==--