Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up my own PKI, and I came across a question to which I couldn't find an answer.

I want to specify CRLDistributionPoints in my server certificates but I am curious whether to use the same URL as I did for the CA or use a separate one for every server certificate. What is "best practice"/reasonable? I don't understand CRLs.

share|improve this question

Each CA certificate is supposed to have one and only one CRL. It is serialized and signed with that CA certificate, and each subsequent serial number supersedes previous ones. However, items should not be removed from it ever. I don't believe behaviour is defined where a CA maintains multiple concurrent CRLs.

That said, as a CA, you may (must) maintain a separate CRL for each CA certificate (subordinate or otherwise).

The reason for multiple crlDistributionPoints is to allow you to increase reliability by giving multiple URLs. This isn't really necessary because there are many different ways to provide reliability, but it can be helpful I am sure in some scenarios.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.