0

I'm new and I'm trying to understand default_crl_days. The default is 30 days thus does it mean after 30 days, the CRL list can no longer be trusted? If so, do we need to generate a new list before 30 days is up?

And what would be the recommended default_crl_days for CRL?

Improve this question

1 Answer 1

Reset to default
0

Yes this is the number of days your CRL is valid. one can create a new CRL before the old one expires, so that they overlap for a short time period, e.g., one day before the current CRL expires. But this is not a must.

The recommended validity period of CRLs depends on your use case and your revocation concept. One issue of CRLs is that a certificate revocation only comes into effect when the new updated CRL gets published and the old CRL is no more valid. E.g., yesterday you published a CRL with 30 day validity period. Today you have to revoke a certifciate. But the certificate will be accepted by the client until the nex CRL is published and the current expires (in 28 days).

Therefore , the validity period of CRLs is usually shorter. Something between 1-7 days. But as mentioned, depends on your use case and revocation concept.

Improve this answer
1
  • 1
    Strictly speaking there is no expiration of a CRL, i.e. a predefined timestamp when it stops being valid. There is only the nextUpdate field which describes the latest time when a new CRL will be issued - which is similar but not really the same as an expiration time of the current CRL. See also x.509 CRLs: next update?.
    – Steffen Ullrich
    Sep 2 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .