Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the X.509 RFC:

DistributionPoint ::= SEQUENCE {
     distributionPoint       [0]     DistributionPointName OPTIONAL,
     reasons                 [1]     ReasonFlags OPTIONAL,
     cRLIssuer               [2]     GeneralNames OPTIONAL }

DistributionPointName ::= CHOICE {
     fullName                [0]     GeneralNames,
     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

GeneralName ::= CHOICE {
     otherName                       [0]     AnotherName,
     rfc822Name                      [1]     IA5String,
     dNSName                         [2]     IA5String,
     x400Address                     [3]     ORAddress,
     directoryName                   [4]     Name,
     ediPartyName                    [5]     EDIPartyName,
     uniformResourceIdentifier       [6]     IA5String,
     iPAddress                       [7]     OCTET STRING,
     registeredID                    [8]     OBJECT IDENTIFIER }


   If the DistributionPointName contains multiple values, each name
   describes a different mechanism to obtain the same CRL.  For example,
   the same CRL could be available for retrieval through both LDAP and

My question is... how do the distribution mechanisms work for each of those? rfc822Name is email, I think, so what are you supposed to do? Shoot the email address specified by that an email and expect it to auto-respond immediately with the CRL?

dNSName is for domain names so what do you do there? Request the TXT record for www.domain.tld? And what about ipAddress? Am I supposed to use a particular protocol to get the CRL?

I have no idea what x400Address, ediPartyName or registeredID are supposed to be..

I guess directoryName is supposed to be another DN but I'm not really sure how that tells you how to get the CRL. Maybe you're supposed to find a CA whose subject matches the certs CRL Distribution Point directory name and see if that contains a URI (or email address or whatever)?

share|improve this question
up vote 4 down vote accepted

In practice, what software can support is uniformResourceIdentifier. The extension then contains a URI which points to the CRL. http:// and ldap:// URL are rather common; https:// URL for CRL download raise interesting issues since the server certificate must then also be validated (so, in practice, it does not work well, or at all).

In situations where machines have a "natural" LDAP server to talk with (e.g. Windows systems in an Active Directory forest), a directoryName can conceivably be handled automatically, by looking at what exists in the LDAP server under that name. I have not seen it working in the wild, though.

For the other name types, well, some make little sense (e.g. dNSName) or would imply human intervention (rfc822Name). The root of the issue is that GeneralName is a really generic structure which is used in many places, and there is no guarantee that any specific GeneralName value makes sense when employed in a specific context, e.g. as part of a CRL distribution point.

If you are writing a generic validator and you just handle http:// URI for CRL download, then you will have already done better than most (most implementations of X.509 do not check revocation at all !). If you also support ldap:// URI, then the term "luxury" could apply. Realistically, the only reasonable thing you can do with the other name types is to totally ignore them.

That's for CRL download but CRL distribution points have another use, which is segmentation. This is what happens when the CRL Distribution Points extension is critical. In that case, you must match the distribution point name with the Issuing Distribution Point extension in the CRL (regardless of how you obtained said CRL). Segmentation is a way for CA to issue smaller CRL, which cover only a subset of the certificates they issued. To know whether you are using the right CRL, you must match the names between the certificate and the CRL. For that, handling the other name types could be necessary. However, this is not about interpreting these names, but just equality tests.

share|improve this answer
The CRL segmentation thing you're talking about sounds like the cRLIssuer field. That said, the X.509 specs says "The extension SHOULD be non-critical, but this profile RECOMMENDS support for this extension by CAs and applications." Is CRL segmentation discussed in another RFC? – neubert Nov 11 '12 at 23:49

Here's a certificate that has just a directoryName distribution point. I guess it's saying to connect to an LDAP server to get the CRL?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.