# What to do with expired certificates as a CA?

This and this answer says that "once a certificate has expired, the CA ceases to keep track of its revocation status".

I'm trying to learn how OpenSSL works as a CA. If I have a revoked expired certificate in my index.txt, then this certificate is not automatically excluded when generating a CRL.

So my questions is:

How do i keep the expired certificates from appearing on the CRL?

• Should i delete all my expired certificates completely?
• If so: do i need to manually edit index.txt to remove it from the database? (I cant find any arguments to openssl ca which deletes certificates from the database)
• There is a command in openssl to revoke a certificate. See this question about the command (the question is actually about a bug in this command). – Uwe Plonus Jul 9 '13 at 9:59
• My question is not how to revoke a certificate, it's what to do with expired certificates – Stian Fauskanger Jul 9 '13 at 10:25

The documentation does not talk about it, but a look at the OpenSSL source code, in the apps/ca.c file, seems to indicate that the -updatedb command-line option will trigger a pruning of the index.txt database, converting expired certificates to "expired" status, which replaces the previous "revoked" or "not revoked" status.