Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in
default_crl_days when the certificate was generated?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes, CRLs must be reissued periodically in all cases. Even if no certificates were revoked. This is because CRLs have validity period with specific end of validity date determined by
Next Update (or
NotAfter) field. You must publish new CRL prior to that time.
If the CRL is expired, certificate chaining engine will reject that CRL and report