In a 2 tier environment, if the Offline Root CA's crl is expired, What is the impact on the intermediate CA and users ? What can i do to minimize the impact ? And if the intermediate CA is now offline, how can i make it online (without making the CA online)?
The impact is negative. Any certificate in the PKI tree will fail revocation checking and most applications will reject your certificates.
What you have to do is to turn on your offline root CA, generate new CRL and copy it to CRL distribution point. You have to start your root CA whenever the following condition occur:
- root CA certificate is near to expire and CA certificate renewal is required.
- a new subordinate CA certificate must be issued or renewed.
- suborinate CA certificate must be revoked.
- root CA CRL is about to expire and must be updated.