Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in
default_crl_days when the certificate was generated?
Yes, CRLs must be reissued periodically in all cases. Even if no certificates were revoked. This is because CRLs have validity period with specific end of validity date determined by
Next Update (or
NotAfter) field. You must publish new CRL prior to that time.
If the CRL is expired, certificate chaining engine will reject that CRL and report