An X.509 certificate revocation list contains a field specifying when the next such list is expected to be issued. I'm trying to figure out the importance of this field...I know that sometimes certificates are placed on a "do not use" list, and this needs to be updated constantly. But I also feel like the CRL update on a regular basis, so what is the point of having this field anyways? Why not just use a fixed schedule?
There are two distinct semantics that the
It is expected that CRL overlap, so that transitions are smooth and network traffic spread throughout the day. Typically, a CA would produce a new CRL every hour (so that fresh information is available) but would "allow" a given CRL to be valid for one day (24 hours). Since a CRL can be somewhat large, downloading it is expensive, thus implementations would prefer not to do it too often if it has no practical use. But since each CA has its own policy, a generic certificate validator cannot know a priori what kind of schedule a given CA uses; it must learn it through the data in the certificates and CRL.
The first meaning is what X.509 mandates. However, everybody uses it with the second meaning. In effect, implementations of X.509 (e.g. in Web browsers, when they validate the certificate of a Web server) handle
It's used for a number of reasons:
See section 220.127.116.11 of RFC3280 for more information.