pkix-5----Page:9
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
|
CRL checking (incorrect state input) Extract from: draft-ietf-pkix-rfc3280bis-01.txt : « This algorithm assumes that all of the needed CRLs are available in a local cache. « This algorithm begins by assuming the certificate is not revoked. The algorithm checks one or more CRLs until either the certificate status is determined to be revoked […] ». The current text is incorrect : “If the revocation status remains undetermined, then return the cert_status UNDETERMINED”. In practice all the needed CRLs may not be in the cache, so the algorithm should start (and finish) with « UNDETERMINED ». |