Clarification to Processing Key Usage Values During Certificate Revocation List (CRL) Validation

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 6
Abstract: RFC 5280 defines the profile of X.509 certificates and Certificate Revocation Lists (CRLs) for use in the Internet. Section 4.2.1.3 of RFC 5280 requires CRL issuer certificates to contain the keyUsage extension with the cRLSign bit asserted. However, the CRL validation algorithm specified in Section 6.3 of RFC 5280 does not explicitly include a corresponding check for the presence of the keyUsage certificate extension. This document updates RFC 5280 to require that check.
Publication Date: 2026-06-01
Status Note: Proposed Standard
DOI: 10.17487/RFC10007
Link: https://doi.org/10.17487/RFC10007
Author(s): Corey Bonnell
Tadahiko Ito
Tomofumi Okubo
Keyword(s): PKI, Certificate Validation, Security

Latest version of IETF RFC 10007

Document Versions — IETF RFC 10007

▶ IETF RFC 10007 (2026-06-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
IETF RFC 5280 [Active, Amended*]
IETF RFC 8174 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC10007.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 10007, Clarification to Processing Key Usage Values During Certificate Revocation List (CRL) Validation. Available at https://doi.org/10.17487/RFC10007

Snippet:

IETF RFC 10007, Clarification to Processing Key Usage Values During Certificate Revocation List (CRL) Validation. Available at https://doi.org/10.17487/RFC10007

HTML (ISO 690 compliant)

Preview:

IETF RFC 10007, Clarification to Processing Key Usage Values During Certificate Revocation List (CRL) Validation. Available at https://doi.org/10.17487/RFC10007

Snippet:

<span class="citation"><cite>IETF RFC 10007</cite>, Clarification to Processing Key Usage Values During Certificate Revocation List (CRL) Validation. Available at <a href="https://doi.org/10.17487/RFC10007" target="_blank" rel="noopener">https://doi.org/10.17487/RFC10007</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 10007, Clarification to Processing Key Usage Values During Certificate Revocation List (CRL) Validation
doi: 10.17487/RFC10007
url: https://doi.org/10.17487/RFC10007

Snippet:

<li>
<cite id="bib-rfc10007">IETF RFC 10007</cite>, Clarification to Processing Key Usage Values During Certificate Revocation List (CRL) Validation
<span class="doi">10.17487/RFC10007</span>
</li>