1

If you look at a DigiCert certificate: https://baltimore-cybertrust-root.chain-demos.digicert.com/info/index.html, you can see that it has the following:

Key:
  Size: 2048 bit RSA
  Key Usage: Certificate Sign, CRL Sign
  Basic Constraints: CA:TRUE

There is no CRL distribution points listed here. Where would I get the CRL distribution URL for this certificate?

Thanks!

Improve this question

1 Answer 1

Reset to default
5

The certificate you referenced is a root certificate. Root certificates do not include a CRL distribution point, because root certificates cannot be revoked.

The CRL distribution point URL you are looking for is included in (all) certificates issued by that root certificate. You can use tools like crt.sh to search for a certificate issued by that root. Then choose a certificate that was issued by that root and inspect it to get the URL of the CRL distribution point.

Here is the CRL distribution point URL you are looking for: http://crl3.digicert.com/Omniroot2025.crl

Improve this answer
2
  • What is CRL useful for?
    – Carlos Garcia
    Feb 21, 2020 at 21:32
  • The CRL (Certificate Revocation List) is a cryptographically signed list that contains the serial number of revoked certificates issued by that particular root or intermediate CA. Browsers nowadays do no longer use the CRL to check for revoked certificates, instead they rely on a mechanism called OCSP or OCSP Stapling. Some browsers also ship their own list of revoked certificates with every browser update (e.g. OneCRL from Mozilla). Other software, like Microsoft Windows, still fetches, caches and honors CRLs.
    – jnsp
    Feb 22, 2020 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.