RFC 5280 section 5.2 (http://tools.ietf.org/html/rfc5280#section-5.2) states:
Conforming CRL issuers are REQUIRED to include the authority key identifier (Section 5.2.1) and the CRL number (Section 5.2.3) extensions in all CRLs issued.
CRLs issued by Dogtag do not include the authority key identifier.
CRL extensions are controlled by CRL settings in CS.cfg. As an initial resolution, we could just enable the Authority Key Identifier extension by default.
Since Authority Key Identifier and CRL Number extensions are REQUIRED, should we remove the ability to disable them at all? If so, this can be done in a separate commit.
attachment pki-ftweedal-0017-Enable-Authority-Key-Identifier-CRL-extension-by-def.patch
Per discussions with ftweedal and cfu: proposed Milestone - 10.2.2
attachment pki-ftweedal-0017-2-Enable-Authority-Key-Identifier-CRL-extension-by-def.patch
pushed to master (9e8c5189ab6cce6ded77316439b9fee92e27487c)
New ticket #1236 created for upgrade script to enable extension on existing instances.
Cherry-picked from master to the following branches:
Metadata Update from @ftweedal: - Issue assigned to ftweedal - Issue set to the milestone: 10.2.2
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/1751
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Login to comment on this ticket.