Subject: | The CRL numbers in Crypt-OpenSSL-CA-0.23/examples/make-crls.pl violates RFC3280 |
Date: | Thu, 21 Feb 2013 09:52:28 +0000 |
To: | "bug-Crypt-OpenSSL-CA [...] rt.cpan.org" <bug-Crypt-OpenSSL-CA [...] rt.cpan.org> |
From: | Johan Finnved <Johan.Finnved [...] cygate.se> |
Hello
The CRL numbers in the example violates 5.2.3 and 5.2.4 of RFC3280.
Using make-crls.pl as an example on how to generate delta CRL can be misleading for novice users.
Violation of 5.2.3:
Since the two CRLs generated do not convey the same revocation status and have different 'This Update' they can not share the same 'CRL number'.
Violation of 5.2.4:
The fields 'CRL number' and 'Delta CRL Indicator' cannot be identical.
In fact 'Delta CRL Indicator' must contain the 'CRL number' of a
earlier complete CRL, so numerically 'Delta CRL Indicator' must be
less than 'CRL number'.
So the complete CRL could have a
CRL number 0xdeadbeefdeadbeefdeadbeefcafe0000
and the delta CRL could have
CRL number 0xdeadbeefdeadbeefdeadbeefcafe0001 and
Delta CRL Indicator 0xdeadbeefdeadbeefdeadbeefcafe0000
Greetings
Johan Finnved
Konsult
Cygate AB
Röntgenvägen 2, 171 54 Solna
växel: 010-8787000
direktnr: 010-8787249