Re: [Sidrops] trying to limit RP processing variability

[Martin Hoffmann <[e-mail]>]

Claudio Jeker wrote:
> On Wed, Apr 15, 2020 at 04:14:15PM +0200, Martin Hoffmann wrote:
> > Job Snijders wrote:  
> > > On Wed, Apr 15, 2020 at 03:01:41PM +0200, Martin Hoffmann wrote:  
> > > >  
> > > > > 1.Manifest present, valid, current    
> > > > 
> > > > If there is a present, valid, and current manifest, the CRL can
> > > > safely be ignored for all objects.    
> > > 
> > > I'd like to ask you for some clarification, Stephen Kent listed 4
> > > different cases, I parapharsed here:
> > > 
> > > 1.1. Manifest present, valid, current AND CRL present, valid,
> > > current 1.2. Manifest present, valid, current AND CRL present,
> > > stale 1.3. Manifest present, valid, current AND CRL present,
> > > invalid 1.4. Manifest present, valid, current AND CRL missing
> > > 
> > > When you say "can safely be ignored", do you mean, MAY be ignored,
> > > SHOULD be ignored? or MUST be ignored? In all four cases?  
> > 
> > In all cases. Since it is ignored, it doesn’t really matter whether
> > it is good or bad or ugly. 
> > 
> > I suppose I would go with "SHOULD be ignored" here.  
> 
> Which CRL are we talking about? The ones listed in the manifest or
> the one referenced by the manifest certificate?

Isn’t that supposed to be the same? Each CA only issues one CRL for all
its issued certificates and replaces it upon update.

Kind regards,
Martin