> As others have pointed out, the DNS already has the capability
> to store certs. So you could use the DNS as a publication
> method. But is this the only thing a PKI needs? How would
> one revolke a cert that was in the DNS? How can you update
> -every- cached copy of the cert in question?
you don't need to. there are in general two options for this sort of
thing:
1) short lived certs
2) CRL's published at regular intervals.
both involve a regularly-signed short-lived objects.
- Bill
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
