Re: X.509 v3 Certificate

Hi Warwick,

We are very pleased to see the X.509 revision moving forward.
Such extensions have been needed for quite some time.  

One immediate observation about the proposed CRL format:

CertificateList ::= SIGNED { SEQUENCE {
     version             Version  OPTIONAL,
                         -- if present, version must be v2--
     signature           AlgorithmIdentifier, 
     issuer              Name,
     thisUpdate               UTCTime,
     nextUpdate               UTCTime OPTIONAL, 
     revokedCertificates      SEQUENCE OF SEQUENCE {
          userCertificate          CertificateSerialNumber, 
          revocationDate           UTCTime,
          crlEntryExtensions       Extensions OPTIONAL } OPTIONAL,
     crlExtensions       [0]  Extensions OPTIONAL }}
     
The OPTIONAL nature of the nextUpdate field is not consistent with
the CRL format in PEM RFC 1422.  Can you explain the reasoning ?

Thanks,
Steve DUsse
RSA