I have a hierarchy of certificates which contains:

  • root-cert
    • server1-CA (issued from root-CA)
      • client1-cert (issued from server1-CA)
    • server2-CA (issued from root-CA)
      • client2-cert (issued from servier2-CA)

I need to generate one CRL file and use it in both server1 and server2 (or in other servers). Can I revoke client certificates using root-CA (to have a unique CRL file)? Or is there a way to merge multiple CRL files ?

1 Answer 1


No, not in practice.

No, you can't. CA can revoke certificates it signed/issued only. There are a number of reasons for this choice. Although, RFC 5280 supports delegated revocation authorities (through registering it in the Issuing Distribution Point CRL extension), in practice it is not implemented by crypto clients in most cases.

One simple example: two CAs issued certificate with matching serial number (serial number uniqueness must be provided for each separate CA key, technically, two CAs may have certs with the same serial number) and you revoke it. The question: which certificate did you revoke?

The only thing you can do is to revoke subordinate CA certificate (effectively revoking all certificates down in path of that subordinate CA).

  • The problem is if I use a unique CRL file in one server, I will have SSLHandshakeException between the server and another non-revoked certificate issued from different serverCA. I get this message : "First cause: Could not determine revocation status"
    – Hakim
    Commented Jan 11, 2017 at 15:33
  • 1
    this means that some CRLs are missing or CRL Distribution Points certificate extension is configured incorrectly.
    – Crypt32
    Commented Jan 11, 2017 at 15:38
  • I didn't configure any CRL Distribution Points, can you please show me how to configure it ?
    – Hakim
    Commented Jan 11, 2017 at 15:53
  • That's problem if you dodn't. I don't know what software you use to run CA servers, but I would suggest to consult with CA server documentation.
    – Crypt32
    Commented Jan 11, 2017 at 15:57
  • I'm using openssl.
    – Hakim
    Commented Jan 11, 2017 at 16:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .