in addition the last sentence in the first paragraph above the table indicates that if the application instance certificate is trusted then the certificate chains are not processed. This should be further explained [if a certificate is trusted i.e. in a trust list, but it is revoked by a CA what would happen - since the application instance certificate is explicitly trusted]

This is related to 2822, because when the revocation list is unavailable but required for path validation
the certificate might be revoked and returning BadCertificateRevocationUnknown / BadCerifitcateIssuerRevocationUnknown
should only be done after successful path Validation (and only when the certificate is trusted).
As far as I remember our discusson around the BadCertificateRevoked vs BadCertificateIssuerRevoked
was that there is obviously a need for an exception for BadCertificateTimeInvalid, because this can happen when clocks
are not synchronized, or when certificates expire unexpectedly, and administrator action like set the system clock or
enable the DisableCertitficateTimeInvalid override need to be taken without unnecessary delays for trouble shooting.

Table 106 – Certificate validation steps
Added to description for Find Revocation List:
Bad_SecurityChecksFailed should be reported back to the Client.

Agreed to changes made in Dallas meeting.

This issue should have an errata back to 1.04 or even 1.03 (raised from CMP group)

Added errata for 1.04 and 1.03

Agreed to 1.03 and 1.04 Errata in Dallas meeting.