Contents
Who maintains CRL?
A CRL is issued by a CRL issuer, which is typically the CA which also issued the corresponding certificates, but could alternatively be some other trusted authority.
Where is CRL stored?
The original CRL file is created and stored at the issuer. It gets provided usually via http/https but other mechanism exists. To know which URL provides the CRL for a specific certificate look at the ‘CRL Distribution Points’ property of the certificate.
What is a CRL on a certificate What purpose does it serve?
The main purpose of a CRL is for CAs to make it known that a site’s digital certificate is not trustworthy. It warns a site’s visitors not to access the site, which may be fraudulently impersonating a legitimate site.
Why is Ocsp better than CRL?
CRL checking is performed first because the CRL usually has a much longer lifetime and, therefore, is more resilient to network outages. OCSP performs frequent requests so, if the network or the OCSP responder is down, users will be unable to log on. If it has been revoked, there is no need to check OCSP.
How long is a CRL valid?
between 1 and 5 years
When generated, a key property imparted on the certificate is how long the certificate will remain valid for – typically between 1 and 5 years. At the end of that duration, the certificate expires and becomes invalid automatically.
Is OCSP dependent on CRL?
OCSP responses are smaller than CRL files and are suitable for devices with limited memory. OCSP stapling is an enhancement to the standard OCSP protocol and is defined in RFC 6066. Enabling OCSP stapling eliminates the need for a browser to send OCSP requests directly to the CA.
How to check the status of a CRL certificate?
To check the status of a certificate using a CRL, the client reaches out to the CA (or CRL issuer) and downloads its certificate revocation list. After doing this, it then must search through the entire list for that individual certificate. This is not only cumbersome but it’s also slow.
Why is a certificate revocation list ( CRL ) necessary?
The CRL is populated by a certificate authority (CA), another part of the PKI. Importantly, only the CA that issued the certificate has the power to revoke it and place it on the CRL. Why is a Certificate Revocation List Necessary? Without a CRL, there’s no way for the PKI to know whether a certificate has been revoked before its expiration.
Can a CRL be accessed over the Internet?
In these Internet scenarios, it makes sense to publish a CRL that can be accessed over HTTP with an Internet FQDN.
When to manually publish the CRL on a separate web server?
Manually publishing the CRL is the only option when there is no connectivity allowed between the intranet and the DMZ, and obviously carries a higher administrative overhead with a higher possibility of error.