In a 2 tier environment, if the Offline Root CA's crl is expired, What is the impact on the intermediate CA and users ? What can i do to minimize the impact ? And if the intermediate CA is now offline, how can i make it online (without making the CA online)?
Add a comment
|
1 Answer
The impact is negative. Any certificate in the PKI tree will fail revocation checking and most applications will reject your certificates.
What you have to do is to turn on your offline root CA, generate new CRL and copy it to CRL distribution point. You have to start your root CA whenever the following condition occur:
- root CA certificate is near to expire and CA certificate renewal is required.
- a new subordinate CA certificate must be issued or renewed.
- suborinate CA certificate must be revoked.
- root CA CRL is about to expire and must be updated.
-
Does it mean, if the CRL is expired, there is no way i can get the subordinate CA up unless i get a new CRL updated on the root CA ?– RakeshCommented Aug 8, 2016 at 9:45
-
yes. During service start, CA service checks its own certificate for revocation. And even if you start the service, client applications will fail revocation check.– Crypt32Commented Aug 8, 2016 at 10:24
-
In my case, the root CA's CRL is expired since 5 years and there seemed to be no impact until today. Do you have any thoughts, about how come everything was working till now ?– RakeshCommented Aug 8, 2016 at 10:41
-
In what applications you are using certificates? Are they really used?– Crypt32Commented Aug 8, 2016 at 12:04
-
Yes and the applications had been working fine until day before yesterday and that's something to be worried about.– RakeshCommented Aug 10, 2016 at 5:28