Contents
How often should CRL be updated?
By default, a CRL validity period is 1 week. That means that the CRL is updated on the Certificate Distribution Point (CDP) every week.
What is the purpose of CRL?
CRLs are a type of blacklist and are used by various endpoints, including Web browsers, to verify whether a certificate is valid and trustworthy. Digital certificates are used in the encryption process to secure communications, most often by using the TLS/SSL protocol.
How long is CRL valid?
between 1 and 5 years
When generated, a key property imparted on the certificate is how long the certificate will remain valid for – typically between 1 and 5 years. At the end of that duration, the certificate expires and becomes invalid automatically.
How is a CRL trimmed after it expires?
It allows for CRLs to be trimmed after the certificate expires, without having to push a new CRL. This is done by automatically removing the CRL entry on the first regular update (i.e. on the next update time) after the certificate expires.
What’s the difference between next update and next CRL publish?
Next Update – a mandatory field that indicates when CRL expires and becomes invalid for revocation checking. Next CRL Publish – an optional extension that indicates the date and time when a CA issues a new CRL. The diagram below displays relations between these fields:
How to check the status of a CRL certificate?
To check the status of a certificate using a CRL, the client reaches out to the CA (or CRL issuer) and downloads its certificate revocation list. After doing this, it then must search through the entire list for that individual certificate. This is not only cumbersome but it’s also slow.
When to replace a CRL in the local cache?
It allows for selection of diff-based vs. complete CRL downloads, since a CRL appearing on or after the next update time is assumed to be a regular update, whereas an update appearing before the next update is assumed to be security patch, so the entire CRL is replaced in the local cache.