[Sidrops] 6486-bis: Out of Scope Manifest Entries

[Martin Hoffmann <[e-mail]>]

Hej igen,

I am not entirely sure what to make of section 6.6 "Out of Scope
Manifest Entries" of the draft 8486-bis. It essentially says that all
objects that are not in the scope of the manifest make the whole fetch
break.

I suppose this is here to deal with multiple CRLs?

But does it also include cases where issued certificates are expired or
revoked? Section 2 (the section references 6.2, but I suppose this is a
mistake) doesn’t quite make that clear since it has non-expired and
non-revoked in parentheses.

Does it also cover other objects that are not signed objects? I
am assuming that anything that isn’t a .crl or .cer must be a signed
object to allow for addition of new objects while staying compatible
with older relying party software. In this case, these would already
have stopped the fetch in section 6.4 as not validating signed objects.

Perhaps the section could be made more clear and list what exactly
constitutes out of scope entries?

Kind regards,
Martin