I use Nginx for client-side authentication. Only the SSL-certificates from the User CA should have access to the application.

The CA hierarchy:

Root CA
Intermediate CA
User CA

So ssl_verify_depth (maximum verification depth) =3

Each CA has a CRL.

For Nginx I need one CRL document.

Do I need to combine the CRLs of Root CA, Intermediate CA and User CA?

  • you can't combine CRLs, it is not supported. Each CA issues its own CRL and chain validator downloads and examines CRLs for each CA separately.
    – Crypt32
    Commented Apr 29, 2020 at 8:37
  • Thank you very much. Maybe combine is the wrong word- you can concatenate multiple PEM-encoded CRLs into one file.see here If I only link to the crl of the User CA, would it be possible that someone with a certificate, which has been signed but since then revoked by the intermediate CA, has access to the server? (Since ssl_verify_depth is a maximum value, a verification depth of 2 could also be possible?) Commented Apr 29, 2020 at 9:55
  • What is the problem of using max depth = 3?
    – Crypt32
    Commented Apr 29, 2020 at 11:24

1 Answer 1


Yes, you can concatenate the CRLs in PEM format. I just worked this out on my own project and confirmed it works.

For example, something like this:

$ # Download the CRLs
$ wget http://example.org/root.crl
$ wget http://example.org/intermediate.crl
$ wget http://example.org/users.crl

$ # Convert to PEM format
$ openssl crl -in root.crl -out root.crl.pem
$ openssl crl -in intermediate.crl -out intermediate.crl.pem
$ openssl crl -in users.crl -out users.crl.pem

$ # Concatenate into single file:
$ cat root.crl.pem > combined.crl.pem
$ cat intermediate.crl.pem >> combined.crl.pem
$ cat users.crl.pem >> combined.crl.pem

And the nginx config

ssl_crl /path/to/combined.crl.pem;

In response to your comment on the question: for me, nginx refused to validate any client certificates until I combined all the CRLs so it could validate the entire chain against the CRLs. So, no, you shouldn't have to worry about a revoked intermediate certificate getting access if you provide only the users CRL because no one will be able to get access until all the CRLs are provided to nginx.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .