In a 2 tier environment, if the Offline Root CA's crl is expired, What is the impact on the intermediate CA and users ? What can i do to minimize the impact ? And if the intermediate CA is now offline, how can i make it online (without making the CA online)?


The impact is negative. Any certificate in the PKI tree will fail revocation checking and most applications will reject your certificates.

What you have to do is to turn on your offline root CA, generate new CRL and copy it to CRL distribution point. You have to start your root CA whenever the following condition occur:

  1. root CA certificate is near to expire and CA certificate renewal is required.
  2. a new subordinate CA certificate must be issued or renewed.
  3. suborinate CA certificate must be revoked.
  4. root CA CRL is about to expire and must be updated.
  • Does it mean, if the CRL is expired, there is no way i can get the subordinate CA up unless i get a new CRL updated on the root CA ? – Rakesh Aug 8 '16 at 9:45
  • yes. During service start, CA service checks its own certificate for revocation. And even if you start the service, client applications will fail revocation check. – Crypt32 Aug 8 '16 at 10:24
  • In my case, the root CA's CRL is expired since 5 years and there seemed to be no impact until today. Do you have any thoughts, about how come everything was working till now ? – Rakesh Aug 8 '16 at 10:41
  • In what applications you are using certificates? Are they really used? – Crypt32 Aug 8 '16 at 12:04
  • Yes and the applications had been working fine until day before yesterday and that's something to be worried about. – Rakesh Aug 10 '16 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.