0

In a 2 tier environment, if the Offline Root CA's crl is expired, What is the impact on the intermediate CA and users ? What can i do to minimize the impact ? And if the intermediate CA is now offline, how can i make it online (without making the CA online)?

Improve this question

1 Answer 1

Reset to default
1

The impact is negative. Any certificate in the PKI tree will fail revocation checking and most applications will reject your certificates.

What you have to do is to turn on your offline root CA, generate new CRL and copy it to CRL distribution point. You have to start your root CA whenever the following condition occur:

  1. root CA certificate is near to expire and CA certificate renewal is required.
  2. a new subordinate CA certificate must be issued or renewed.
  3. suborinate CA certificate must be revoked.
  4. root CA CRL is about to expire and must be updated.
Improve this answer
5
  • Does it mean, if the CRL is expired, there is no way i can get the subordinate CA up unless i get a new CRL updated on the root CA ?
    – Rakesh
    Commented Aug 8, 2016 at 9:45
  • yes. During service start, CA service checks its own certificate for revocation. And even if you start the service, client applications will fail revocation check.
    – Crypt32
    Commented Aug 8, 2016 at 10:24
  • In my case, the root CA's CRL is expired since 5 years and there seemed to be no impact until today. Do you have any thoughts, about how come everything was working till now ?
    – Rakesh
    Commented Aug 8, 2016 at 10:41
  • In what applications you are using certificates? Are they really used?
    – Crypt32
    Commented Aug 8, 2016 at 12:04
  • Yes and the applications had been working fine until day before yesterday and that's something to be worried about.
    – Rakesh
    Commented Aug 10, 2016 at 5:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .