I'm trying to learn how OpenSSL works as a CA. If I have a revoked expired certificate in my index.txt, then this certificate is not automatically excluded when generating a CRL.
So my questions is:
How do i keep the expired certificates from appearing on the CRL?
- Should i delete all my expired certificates completely?
- If so: do i need to manually edit index.txt to remove it from the database? (I cant find any arguments to openssl ca which deletes certificates from the database)