Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
This question is specifically about certificates that should have had a long lifetime, but were revoked quickly.
Is every CRL issued by this CA guaranteed to include its revocation, as long as the original certificate would still be valid?
Or is there a limit after which the CA just assumes that everybody updated their certificates to a list which doesn't include the revoked certificate?
Is every CRL issued by this CA guaranteed to include its revocation, as long as the original certificate would still be valid?
Well, of course nothing is ever guaranteed, but that is at least required from compliant PKIs:
| RFC 5280 section 5 |
|---|
| A complete CRL lists all unexpired certificates, within its scope, that have been revoked for one of the revocation reasons covered by the CRL scope. A full and complete CRL lists all unexpired certificates issued by a CA that have been revoked for any reason. |
Actually it must even appear on at least the first CRL thereafter (thanks to dave_thompson_085):
| RFC 5280 section 3.3 |
|---|
| An entry MUST NOT be removed from the CRL until it appears on one regularly scheduled CRL issued beyond the revoked certificate's validity period. |
Delta CRLs, by definition, only contain differences to their base CRL.
And temporarily suspended certificates only appear on the CRL for the time of their suspension.
According to ETSI EN 319 411-2:
CSS-6.3.10-02: Revocation status information shall be made available beyond the validity period of the certificate.
Where CRLs are provided:
• CSS-6.3.10-03 [CONDITIONAL]: If CRLs are provided, the TSP should not remove from the CRL revoked certificates after they have expired.
• CSS-6.3.10-04 [CONDITIONAL]: If CRLs are provided and no alternative means (e.g. OCSP) are provided for revocation status information on expired certificates, the TSP shall not remove from the CRL revoked certificates after they have expired.
