We rewrote text in part 83. Part 4 is not updated yet. We keep this open as a reminder.

This is now in section 7.8.2 in part83

RFC 5280 which is referenced in part 83 in table 3 "revocation checks" states in section 6.3.3:

(f) Obtain and validate the certification path for the issuer of
the complete CRL. The trust anchor for the certification
path MUST be the same as the trust anchor used to validate
the target certificate. If a key usage extension is present
in the CRL issuer's certificate, verify that the cRLSign bit
is set.

(g) Validate the signature on the complete CRL using the public
key validated in step (f).

So the CRL validity is covered by the RFC.

Suggest to close this issue with no changes to the spec.

No change is required since the "missing" step is covered in RFC 5280

One small change was done in pat 83 in section 7.8.1 Table 3.
The statement "The certificate shall not be revoked" in the last two of the table, is difficult to understand.
The statement was removed - the information how to check a revocation is kept.

Team agreed to close this

closed