Re: X509 Path Discovery Test 4.1.1.10

["David A. Cooper" <david.cooper@nist.gov>]

Sean,

In this test, the end entity certificate includes a 
cRLDistributionPoints extension that points to the CRL.  In any test 
where the description states that the CRL is not stored in the CA's 
directory entry, the certificate that is covered by that CRL includes a 
cRLDistributionPoints extension that points to the CRL.

This has been a source of confusion for several people.  In the next 
draft of the test suite, I will need to ensure that the test 
descriptions mention the presence of the cRLDistributionPoints extension.

Thanks,

Dave

Sean Mullan wrote:

>
> This test says that "The intermediate CA has issued a CRL, which is 
> not stored in the CA's directory entry, that lists the end-entity 
> certificate as being revoked."
>
> What does that mean exactly? Where is the CRL stored?
>
> Thanks,
> Sean