Re: [Sidrops] once again, with feeling ...

[Stephen Kent <[e-mail]>]

Tim,
>
>> 6.  Relying Party Use of Manifests
>>   
>> <snip/>
>>   
>> The primary locator for the CRL issued by a CA is the URI contained in the CRLDP contained in the CA’s certificate.
> That would be the CRL issued by the parent to this CA, no?
Whoops. My bad. I should refer to the CRLDP in the manifest being 
fetched, not in the CA cert. I will fix that.
>
>> An RP MUST use this URI to
>> retrieve the CRL and use that CRL to determine if the EE certificate in
>> the manifest is revoked. The manifest provides an RP with a means to
>> verify that the CRL at the indication location is current.
> I thought that we would expect that the CRLDP of the MFT EE is used, and that this URI matches the id-ad-caRepository SIA in the issuing CA certificate + the name of the one and only '.crl' entry in the manifest content.

Yes, we want to compare the CRLDP in the manifest's EE cert against the 
SIA URI from the CA cert. I'll revise this text.

Thanks for noticing these errors. Rev 4 will be posted immediately.

Steve