Re: X509 Path Discovery Test 4.1.1.10

[Sean Mullan <Sean.Mullan@Sun.COM>]

Thanks for the clarification. From the description, I wasn't sure if the 
CRL was simply not available (and whether the test was supposed to fail 
because it couldn't find an appropriate CRL). Mentioning the CRLDP would 
help.

--Sean

David A. Cooper wrote:
> Sean,
> 
> In this test, the end entity certificate includes a 
> cRLDistributionPoints extension that points to the CRL.  In any test 
> where the description states that the CRL is not stored in the CA's 
> directory entry, the certificate that is covered by that CRL includes a 
> cRLDistributionPoints extension that points to the CRL.
> 
> This has been a source of confusion for several people.  In the next 
> draft of the test suite, I will need to ensure that the test 
> descriptions mention the presence of the cRLDistributionPoints extension.
> 
> Thanks,
> 
> Dave
> 
> Sean Mullan wrote:
> 
>>
>> This test says that "The intermediate CA has issued a CRL, which is 
>> not stored in the CA's directory entry, that lists the end-entity 
>> certificate as being revoked."
>>
>> What does that mean exactly? Where is the CRL stored?
>>
>> Thanks,
>> Sean
> 
>