1

I would like to understand how is CRL verified and therefore certificate of end entity verified when there is a new certificate and keys of issuing CA renewed.

Suppose I have the following setup:

  1. Issuing CA publishing CRL
  2. End entity certificates issued by Issuing CA
  3. Validation service that validates issued end entity certificates through certificate chain and CRL

When there is no change, certificate would be validated without any issues.

But what happens when I renew CA certificate with new keys? The DN of CA certificate would be the same but the published CRL would be signed by different key. Old CA certificate and keys would be still valid because its expiration date wasn't reached yet, but it would not be used to publish new CRLs.

How would be end entity certificate issued before renewing CA validated with renewed CA certificate and its corresponding CRLs?

Improve this question

1 Answer 1

Reset to default
0

The CRL contains only information about the certificates issued by this particular CA with this particular public key. Revocation information for certificates issued with the older CA key are contained in another CRL file. Which CRL file need to be used to verify revocation for a specific certificate is contained in the certificate itself as CRL distribution point.

Improve this answer
4
  • But end entity certificate contains only one CRL distribution point. When there will be renewed CA then the CRLs would be on the same location. Then the end entity certificate would't be validate because of CRL issued by renewed CA. I would like to know how is such situation resolved practically.
    – user1563721
    Commented Oct 26, 2015 at 8:44
  • @user1563721: A certificate is issued by a single CA/key and it contains the CRL distribution point specific for the issuer, i.e. certificates issued by the new CA will point the new CRL and certificates issued by the old CA will point to the old CRL path. This is similar to two distinct CA's.
    – Steffen Ullrich
    Commented Oct 26, 2015 at 9:05
  • So when I rewrite CRL file on the CRL DP with the CRL issued by renewed CA, then I'm stuck in validating certificates issued by CA before renewal right? Why there is something like renewal CA when it is basically creating new CA with new CRL DP and other attributes. I don't see a reason to renew CA then.
    – user1563721
    Commented Oct 26, 2015 at 10:33
  • @user1563721: A CA needs to be renewed for the same reasons as certificates: the life time expired or the key is considered too weak.
    – Steffen Ullrich
    Commented Oct 26, 2015 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .