CRL 發布點

CRL Distribution Points

The CRL Distribution Points extension MUST be present in:

CRL 發布點（CRL Distribution Points）擴充欄位應（MUST）存在於：

• Subordinate CA Certificates; and
• Subscriber Certificates that 1) do not qualify as “Short-lived Subscriber Certificates” and 2) do not include an Authority Information Access extension with an id-ad-ocsp accessMethod.

• 下屬憑證機構（Subordinate CA）憑證；及
• （1）不符合「短效期用戶憑證」資格，且（2）未包含具有 id-ad-ocsp accessMethod 之憑證機構資訊存取（AIA）擴充欄位的用戶憑證。

The CRL Distribution Points extension SHOULD NOT be present in:

CRL 發布點擴充欄位不宜（SHOULD NOT）存在於：

• Root CA Certificates.

• 根憑證機構（Root CA）憑證。

The CRL Distribution Points extension is OPTIONAL in:

CRL 發布點擴充欄位於以下情況為選用（OPTIONAL）：

• Short-lived Subscriber Certificates.

• 短效期用戶憑證（Short-lived Subscriber Certificates）。

The CRL Distribution Points extension MUST NOT be present in:

CRL 發布點擴充欄位不得（MUST NOT）存在於：

• OCSP Responder Certificates.

• OCSP 回應伺服器（OCSP Responder）憑證。

When present, the CRL Distribution Points extension MUST contain at least one DistributionPoint; containing more than one is NOT RECOMMENDED. All DistributionPoint items must be formatted as follows:

若存在，CRL 發布點擴充欄位應（MUST）包含至少一個 DistributionPoint；若包含超過一個，則不建議（NOT RECOMMENDED）。所有 DistributionPoint 應依下列格式編排：

DistributionPoint profile

Field	Presence	Description
distributionPoint	MUST	The DistributionPointName MUST be a fullName formatted as described below.
reasons	MUST NOT
cRLIssuer	MUST NOT

A fullName MUST contain at least one GeneralName; it MAY contain more than one. All GeneralNames MUST be of type uniformResourceIdentifier, and the scheme of each MUST be “http”. The first GeneralName must contain the HTTP URL of the Issuing CA’s CRL service for this certificate.

fullName 應（MUST）包含至少一個 GeneralName；得（MAY）包含超過一個。所有 GeneralName 應（MUST）為 uniformResourceIdentifier 類型，且每個 scheme 應（MUST）為「http」。第一個 GeneralName 應包含本憑證之簽發憑證機構（Issuing CA）所提供之 CRL 服務的 HTTP URL。