Re: [Sidrops] rev 4 (corrected CRLDP source changes, thanks to Tim)

[Martin Hoffmann <[e-mail]>]

Stephen Kent wrote:
> Tim,
>
> > If not, then indeed we need to have a discussion about how to deal
> > properly with multiple CRLS. E.g. do you check *all* of them for
> > each issued certificate, or do you only check the CRL matching the
> > CRLDP of that certificate? I would also be very curious to know
> > which use case warrants having this complexity.  
> 
> My suggestion is the KISS approach - first .crl file that has a valid 
> hash is the one to use, and others are ignored. That's less forgiving 
> than what Rob accommodates, but being forgiving here might take
> pressure of a CA to do its job properly.

I’m not sure it really does. Rather, it will lead to strange looking
issues: If the wrong CRL accidentally made it onto the manifest and it
comes first, all objects are invalid even though everything sort of
looks fine. This may even come and go if a CA reorders the CRLs when
it reissues the manifest[0]. If all CRLs are referenced by objects, some
objects suddenly are invalid while others aren’t.

I think invalidating the manifest with a clear warning is the more
straightforward approach and much easier to debug.

Kind regards,
Martin

[0] That may happen if it is file system based and just adds files as
    they appear when reading the directory without sorting the file
    names first.