0

This question is specifically about certificates that should have had a long lifetime, but were revoked quickly.

Is every CRL issued by this CA guaranteed to include its revocation, as long as the original certificate would still be valid?

Or is there a limit after which the CA just assumes that everybody updated their certificates to a list which doesn't include the revoked certificate?

2 Answers 2

3

Is every CRL issued by this CA guaranteed to include its revocation, as long as the original certificate would still be valid?

Well, of course nothing is ever guaranteed, but that is at least required from compliant PKIs:

RFC 5280 section 5
A complete CRL lists all unexpired certificates, within its scope, that have been revoked for one of the revocation reasons covered by the CRL scope. A full and complete CRL lists all unexpired certificates issued by a CA that have been revoked for any reason.

Actually it must even appear on at least the first CRL thereafter (thanks to dave_thompson_085):

RFC 5280 section 3.3
An entry MUST NOT be removed from the CRL until it appears on one regularly scheduled CRL issued beyond the revoked certificate's validity period.

Delta CRLs, by definition, only contain differences to their base CRL.

And temporarily suspended certificates only appear on the CRL for the time of their suspension.

1
  • And at least the first 'regularly scheduled' (whatever that means) CRL after expiration, see 3.3. Mar 13, 2023 at 0:44
0

According to ETSI EN 319 411-2:

CSS-6.3.10-02: Revocation status information shall be made available beyond the validity period of the certificate.

Where CRLs are provided:

• CSS-6.3.10-03 [CONDITIONAL]: If CRLs are provided, the TSP should not remove from the CRL revoked certificates after they have expired.

• CSS-6.3.10-04 [CONDITIONAL]: If CRLs are provided and no alternative means (e.g. OCSP) are provided for revocation status information on expired certificates, the TSP shall not remove from the CRL revoked certificates after they have expired.

1
  • These are (sensible!) requirements for trust service providers issuing EU qualified certificates. But the OP did not indicate that they are interested in only such TSPs.
    – mkl
    Mar 13, 2023 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .