Contents
What is CRL format?
A Certificate Revocation List (CRL) is a cryptographically-signed list of certificates that a certificate authority has declared to be revoked. A CRL file may be encoded in PEM format, DER format, or possibly some other format. CRL files are becoming less widely-used, in favor of the OCSP protocol.
What is Delta CRL?
Delta CRLs: A Delta CRL is a CRL that contains all non-expired certificates that have been revoked since the last base CRL was published. If just Base CRLs are used then a client checking revocation only needs to download the Base CRL to determine if a certificate is revoked.
How do I get a CRL list?
One of which is through using Google Chrome and checking the certificate details. To do this, open the Chrome DevTools, navigate to the security tab and click on View certificate. From here, click on Details, and scroll down to where you’ll see “CRL Distribution Points”.
Does a CRL expire?
When generated, a key property imparted on the certificate is how long the certificate will remain valid for – typically between 1 and 5 years. At the end of that duration, the certificate expires and becomes invalid automatically.
Is the Delta CRL the same as the full CRL?
In my lab for example, my Certificate Authority issues a CRL file name rjglab-CA.crl and the delta files are named the same as the full CRL but they are appended with the plus character making the file name rjglab-CA+.crl.
Which is the base CRL in Microsoft certificate services?
A “normal” setup with Microsoft’s Certificate Services involves two CRL files: a base CRL and a delta CRL. The base CRL is destined to be referenced from a CRL Distribution Points extension in the issued certificate. The base CRL will contain a Freshest CRL extension which itself points to the delta CRL.
Why are delta CRLs not accessible on IIS?
If you are only publishing full CRLs then you will have no problems however if you are publishing Delta CRLs, the smaller, faster to process kind which list only certificates revoked since the last full publish then you may encounter an issue if you are using an IIS website to publish these. The problem lies in the filename used for the CRLs.
When does a certificate go off the CRL?
An expired certificate is rejected at the first step of the authentication process, well before the CRL is checked, so there’s no need to include it there. Furthermore, certificates that reach their expiration date while on a CRL are automatically removed from the list.