Given a root certificate authority (CA) and an intermediate CA signed by the root:
Which CRL should the crlDistributionPoints contain to for the intermediate CA? The root CA's CRL or the intermediate CA's CRL?
It makes sense that each certificate should point to the CRL of the CA that signed it.
Which CRL should the root CA contain, if any?
It would seem that since it is self-signed, it should point to it's own CRL.
Should user or server certificates signed by the intermediate CA point to the intermediate CA's CRL, or both the intermediate's and the root's CRLs?
Please cite the RFC if you can. I can't find a clear answer there myself.
Asked another way, where would a client look for a CRL to see if a given certificate has been revoked? In the certificate itself or in the signing CA's certificate?