> and that's where you find the crl. I don't know. I punt to pkix to decide > what the "URL" means. I think that there are documents now that tell me > how to get stuff via HTTP, right?
Yes, and there's also apparently some way to embed URLs pointing to (multiple) CRL distribution points into certificates.
The CRL distribution points extension identifies how CRL information is obtained. The extension SHOULD be non-critical, but this profile RECOMMENDS support for this extension by CAs and applications.