Here's an example PKI setup:
* Root CA (offline) * Issuing CA * Client 1 * Client 2
I'd like to specify a CRL distribution point for CRLs generated by Root CA, and an OCSP URL for Issuing CA. So information about revoked client certificates is available only via OCSP. Information about a revoked Issuing CA (hopefully never needed) is available only via CRL.
The question is which one of these two ways is the correct way to communicate this policy:
* Root CA (CRL distribution point = http://...) * Issuing CA (OCSP = http://...) * Client 1 * Client 2
* Root CA * Issuing CA (CRL distribution point = http://...) * Client 1 (OCSP = http://...) * Client 2 (OCSP = http://...)
Basically, I'm confused about who specifies URIs for obtaining revocation information. Is this specified in the CA's certificate, meaning "I'm the CA, and this is where I'll tell you about certificates I've issued that are no longer valid," or is this specified in the client certificate, meaning "if this certificate gets revoked, here's where you'll find out about it?"
I've looked through RFC 5280 and couldn't find a clear answer to this question. Most examples suggest that the second way is correct, but the first one seems to make more sense to me. Which one is it?
If the second way is correct, is there any reason to also specify CRL distribution points in the Root CA?