Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From the X.509 RFC:

DistributionPoint ::= SEQUENCE {
     distributionPoint       [0]     DistributionPointName OPTIONAL,
     reasons                 [1]     ReasonFlags OPTIONAL,
     cRLIssuer               [2]     GeneralNames OPTIONAL }

DistributionPointName ::= CHOICE {
     fullName                [0]     GeneralNames,
     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

GeneralName ::= CHOICE {
     otherName                       [0]     AnotherName,
     rfc822Name                      [1]     IA5String,
     dNSName                         [2]     IA5String,
     x400Address                     [3]     ORAddress,
     directoryName                   [4]     Name,
     ediPartyName                    [5]     EDIPartyName,
     uniformResourceIdentifier       [6]     IA5String,
     iPAddress                       [7]     OCTET STRING,
     registeredID                    [8]     OBJECT IDENTIFIER }

Also....

   If the DistributionPointName contains multiple values, each name
   describes a different mechanism to obtain the same CRL.  For example,
   the same CRL could be available for retrieval through both LDAP and
   HTTP.

My question is... how do the distribution mechanisms work for each of those? rfc822Name is email, I think, so what are you supposed to do? Shoot the email address specified by that an email and expect it to auto-respond immediately with the CRL?

dNSName is for domain names so what do you do there? Request the TXT record for www.domain.tld? And what about ipAddress? Am I supposed to use a particular protocol to get the CRL?

I have no idea what x400Address, ediPartyName or registeredID are supposed to be..

I guess directoryName is supposed to be another DN but I'm not really sure how that tells you how to get the CRL. Maybe you're supposed to find a CA whose subject matches the certs CRL Distribution Point directory name and see if that contains a URI (or email address or whatever)?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

In practice, what software can support is uniformResourceIdentifier. The extension then contains a URI which points to the CRL. http:// and ldap:// URL are rather common; https:// URL for CRL download raise interesting issues since the server certificate must then also be validated (so, in practice, it does not work well, or at all).

In situations where machines have a "natural" LDAP server to talk with (e.g. Windows systems in an Active Directory forest), a directoryName can conceivably be handled automatically, by looking at what exists in the LDAP server under that name. I have not seen it working in the wild, though.

For the other name types, well, some make little sense (e.g. dNSName) or would imply human intervention (rfc822Name). The root of the issue is that GeneralName is a really generic structure which is used in many places, and there is no guarantee that any specific GeneralName value makes sense when employed in a specific context, e.g. as part of a CRL distribution point.

If you are writing a generic validator and you just handle http:// URI for CRL download, then you will have already done better than most (most implementations of X.509 do not check revocation at all !). If you also support ldap:// URI, then the term "luxury" could apply. Realistically, the only reasonable thing you can do with the other name types is to totally ignore them.


That's for CRL download but CRL distribution points have another use, which is segmentation. This is what happens when the CRL Distribution Points extension is critical. In that case, you must match the distribution point name with the Issuing Distribution Point extension in the CRL (regardless of how you obtained said CRL). Segmentation is a way for CA to issue smaller CRL, which cover only a subset of the certificates they issued. To know whether you are using the right CRL, you must match the names between the certificate and the CRL. For that, handling the other name types could be necessary. However, this is not about interpreting these names, but just equality tests.

share|improve this answer
    
The CRL segmentation thing you're talking about sounds like the cRLIssuer field. That said, the X.509 specs says "The extension SHOULD be non-critical, but this profile RECOMMENDS support for this extension by CAs and applications." Is CRL segmentation discussed in another RFC? –  neubert Nov 11 '12 at 23:49

Here's a certificate that has just a directoryName distribution point. I guess it's saying to connect to an LDAP server to get the CRL?

-----BEGIN CERTIFICATE-----
MIIDIDCCAomgAwIBAgIENd70zzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJVUzEQMA4GA1UE
ChMHRXF1aWZheDEtMCsGA1UECxMkRXF1aWZheCBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5
MB4XDTk4MDgyMjE2NDE1MVoXDTE4MDgyMjE2NDE1MVowTjELMAkGA1UEBhMCVVMxEDAOBgNVBAoT
B0VxdWlmYXgxLTArBgNVBAsTJEVxdWlmYXggU2VjdXJlIENlcnRpZmljYXRlIEF1dGhvcml0eTCB
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwV2xWGcIYu6gmi0fCG2RFGiYCh7+2gRvE4RiIcPR
fM6fBeC4AfBONOziipUEZKzxa1NfBbPLZ4C/QgKO/t0BCezhABRP/PvwDN1Dulsr4R+AcJkVV5MW
8Q+XarfCaCMczE1ZMKxRHjuvK9buY0V7xdlfUNLjUA86iOe/FP3gx7kCAwEAAaOCAQkwggEFMHAG
A1UdHwRpMGcwZaBjoGGkXzBdMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHRXF1aWZheDEtMCsGA1UE
CxMkRXF1aWZheCBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MQ0wCwYDVQQDEwRDUkwxMBoG
A1UdEAQTMBGBDzIwMTgwODIyMTY0MTUxWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUSOZo+SvS
spXXR9gjIBBPM5iQn9QwHQYDVR0OBBYEFEjmaPkr0rKV10fYIyAQTzOYkJ/UMAwGA1UdEwQFMAMB
Af8wGgYJKoZIhvZ9B0EABA0wCxsFVjMuMGMDAgbAMA0GCSqGSIb3DQEBBQUAA4GBAFjOKer89961
zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y7qj/WsjTVbJmcVfewCHrPSqnI0kB
BIZCe/zuf6IWUrVnZ9NA2zsmWLIodz2uFHdh1voqZiegDfqnc1zqcPGUIWVEX/r87yloqaKHee95
70+sB3c4
-----END CERTIFICATE-----
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.