[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Query on draft-ietf-ipsec-pki-req-03.txt
Greg,
Yes, I know; a lot of implementations do forward CRLs as part of their
negotiations. The question is whether this must be required. If the draft
requires all implementations do certificate validation, then I don't see how
conformance is possible unless the draft also requires implementations to
pass CRLs.
-- Jesse
-----Original Message-----
From: Greg Carter [mailto:greg.carter@entrust.com]
Sent: Tuesday, October 19, 1999 9:33 AM
To: 'Walker, Jesse'; 'ipsec@lists.tislabs.com'
Subject: RE: Query on draft-ietf-ipsec-pki-req-03.txt
Hi Jesse,
Yes if you receive a certificate request with type CRL then you should send
the CRL that your certificate would be put on were it to be revoked (follow?
:) ). Many implementations are doing this. Of course this requires that at
least one end of the negotiation has access to the CRL repository.
Bye.
Greg Carter
Entrust Technologies - http://www.entrust.com
http://www.ford-trucks.com/articles/buildup/dana60.html
-----Original Message-----
From: Walker, Jesse [mailto:jesse.walker@intel.com]
Sent: Tuesday, October 19, 1999 10:56 AM
To: 'ipsec@lists.tislabs.com'
Subject: Query on draft-ietf-ipsec-pki-req-03.txt
or the security gateway's cert gets validated. Maybe we need to require
implementations to send the latest CRL known to them during the IKE phase 1
negotiation?
Follow-Ups: