Re: CRLs and self-signed root certs.

[Peter Gutmann]

Goetz Babin-Ebell <[EMAIL PROTECTED]> writes:

>Everybody can issue a CRL.

Only a CA with CRL signing enabled can issue a CRL.

>A CA can issue a CRL with own revokated certificates but it can issue a CRL
>with revoked certificates of other CAs (at least in X509v3...)

A CA can't revoke another CA's certificates, only certificates which it has
issued.

Peter.


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]