Should a CA publish updated CRLs even if they did not revoke any certificates? And what will happen if the latest CRL is older than what allowed in default_crl_days when the certificate was generated?


| improve this question | | | | |

Yes, CRLs must be reissued periodically in all cases. Even if no certificates were revoked. This is because CRLs have validity period with specific end of validity date determined by Next Update (or NotAfter) field. You must publish new CRL prior to that time.

If the CRL is expired, certificate chaining engine will reject that CRL and report RevocationOffline error.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.