Re: [sidr] Validation Reconsidered (again/again) question

[Stephen Kent <[e-mail]>]

Geoff,


> ...
>> 2. How do you perform the validation of a CRL?
> RFC6487 provided no guidance, and referred to RFC5280, so that is still the case.
> nothing changes herre.
RFC 6487 modified the validation algorithm from 5280, and stated that the
revised algorithm applies to "resource certificates." A CA cert issued in
the RPKI is a resource certificate. Thus to verify the signature on a CRL
one must use a valid CA cert. Thus Sriram's question was, I believe, more
precisely stated as how does the revised validation procedure apply to a CA
cert, which is then used to verify the signature on a CRL.
>> How is it similar to or different from how you validate a ROA?
> There are no resources in a CRL so I presume that section 6.1 of RFC5280 is
> a good procedure to follow.
see comment above.
>> How do you walk the certificate hierarchy in the case of a CRL validation process?
>> I.e. How are the "encompassing" rules applied?
> huh - I’ll say it again just to be sure: CRLs have no resources.
but the CA cert used to verify a CRL signature does contain resources,
and that, I believe, was the issue Sriram was raising, and that my message
raised.

Steve