What is root CRL?
A Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their scheduled expiration date and should no longer be trusted. The CRL file is signed by the Certificate Authority to prevent tampering.
What is CRL distribution point?
A CRL distribution point (CDP) is a location on an LDAP directory server or Web server where a CA publishes CRLs. In this case, the system validates the user by verifying only the CRL specified in the client certificate.
Is the AIA filed of intermediate CA applicable to root CA?
• The AIA filed of Intermediate CA points to the location of its issuing CA, which is Root CA. • AIA is not applicable for Root CA, as it is using self signed certificate. Moreover, Root CA is the Trust Anchor which should already be trusted by the web browser.
Where are the AIA and CRL distribution points located?
The “Authority Information Access” (AIA) and “CRL Distribution Points” (CRLDP) extensions are information which is written in the certificates issued by the CA. In that case, these extensions are in the CA certificates issued to the subordinate CA (the three subdomain CA).
Can a self signed root certificate have AIA?
Self signed root certificates shouldn’t have AIA — there’s no CRL that will be checked by PKIX conforming implementations. If you have a service that uses certificates issued by your own root, but that must be verifiable using only the other CA then the intermediate should have AIA extension — it’s not a root certificate any more.
Can a trusted root CA produce a CRL?
In an Active Directory context, you can push the root CA as “trusted” through, for instance, some GPO. To automate CRL publication, you could use a mostly offline root CA. That’s a root CA which is offline except that it has an inherently one-way channel to output regularly produced CRL.