distribution mechanisms for CRLs

Question

DistributionPoint ::= SEQUENCE {
     distributionPoint       [0]     DistributionPointName OPTIONAL,
     reasons                 [1]     ReasonFlags OPTIONAL,
     cRLIssuer               [2]     GeneralNames OPTIONAL }

DistributionPointName ::= CHOICE {
     fullName                [0]     GeneralNames,
     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

GeneralName ::= CHOICE {
     otherName                       [0]     AnotherName,
     rfc822Name                      [1]     IA5String,
     dNSName                         [2]     IA5String,
     x400Address                     [3]     ORAddress,
     directoryName                   [4]     Name,
     ediPartyName                    [5]     EDIPartyName,
     uniformResourceIdentifier       [6]     IA5String,
     iPAddress                       [7]     OCTET STRING,
     registeredID                    [8]     OBJECT IDENTIFIER }

Also....

   If the DistributionPointName contains multiple values, each name
   describes a different mechanism to obtain the same CRL.  For example,
   the same CRL could be available for retrieval through both LDAP and
   HTTP.

My question is... how do the distribution mechanisms work for each of those? rfc822Name is email, I think, so what are you supposed to do? Shoot the email address specified by that an email and expect it to auto-respond immediately with the CRL?

dNSName is for domain names so what do you do there? Request the TXT record for www.domain.tld? And what about ipAddress? Am I supposed to use a particular protocol to get the CRL?

I have no idea what x400Address, ediPartyName or registeredID are supposed to be..

I guess directoryName is supposed to be another DN but I'm not really sure how that tells you how to get the CRL. Maybe you're supposed to find a CA whose subject matches the certs CRL Distribution Point directory name and see if that contains a URI (or email address or whatever)?

Thomas Pornin · Accepted Answer · 2012-11-11 20:53:05Z

In practice, what software can support is uniformResourceIdentifier. The extension then contains a URI which points to the CRL. http:// and ldap:// URL are rather common; https:// URL for CRL download raise interesting issues since the server certificate must then also be validated (so, in practice, it does not work well, or at all).

In situations where machines have a "natural" LDAP server to talk with (e.g. Windows systems in an Active Directory forest), a directoryName can conceivably be handled automatically, by looking at what exists in the LDAP server under that name. I have not seen it working in the wild, though.

For the other name types, well, some make little sense (e.g. dNSName) or would imply human intervention (rfc822Name). The root of the issue is that GeneralName is a really generic structure which is used in many places, and there is no guarantee that any specific GeneralName value makes sense when employed in a specific context, e.g. as part of a CRL distribution point.

If you are writing a generic validator and you just handle http:// URI for CRL download, then you will have already done better than most (most implementations of X.509 do not check revocation at all !). If you also support ldap:// URI, then the term "luxury" could apply. Realistically, the only reasonable thing you can do with the other name types is to totally ignore them.

That's for CRL download but CRL distribution points have another use, which is segmentation. This is what happens when the CRL Distribution Points extension is critical. In that case, you must match the distribution point name with the Issuing Distribution Point extension in the CRL (regardless of how you obtained said CRL). Segmentation is a way for CA to issue smaller CRL, which cover only a subset of the certificates they issued. To know whether you are using the right CRL, you must match the names between the certificate and the CRL. For that, handling the other name types could be necessary. However, this is not about interpreting these names, but just equality tests.

The CRL segmentation thing you're talking about sounds like the cRLIssuer field. That said, the X.509 specs says "The extension SHOULD be non-critical, but this profile RECOMMENDS support for this extension by CAs and applications." Is CRL segmentation discussed in another RFC?

neubert · Answer 2 · 2012-11-12 02:55:43Z

Here's a certificate that has just a directoryName distribution point. I guess it's saying to connect to an LDAP server to get the CRL?

asked	6 months ago
viewed	149 times
active	2 months ago

distribution mechanisms for CRLs

2 Answers

Your Answer

Not the answer you're looking for? Browse other questions tagged certificates public-key-infrastructure certificate-authority x.509 certificate-revocation or ask your own question.

distribution mechanisms for CRLs

2 Answers

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged certificates public-key-infrastructure certificate-authority x.509 certificate-revocation or ask your own question.

Related