This and this answer says that "once a certificate has expired, the CA ceases to keep track of its revocation status".

I'm trying to learn how OpenSSL works as a CA. If I have a revoked expired certificate in my index.txt, then this certificate is not automatically excluded when generating a CRL.

So my questions is:

How do i keep the expired certificates from appearing on the CRL?

  • Should i delete all my expired certificates completely?
  • If so: do i need to manually edit index.txt to remove it from the database? (I cant find any arguments to openssl ca which deletes certificates from the database)
  • There is a command in openssl to revoke a certificate. See this question about the command (the question is actually about a bug in this command).
    – Uwe Plonus
    Jul 9, 2013 at 9:59
  • My question is not how to revoke a certificate, it's what to do with expired certificates Jul 9, 2013 at 10:25

2 Answers 2


The documentation does not talk about it, but a look at the OpenSSL source code, in the apps/ca.c file, seems to indicate that the -updatedb command-line option will trigger a pruning of the index.txt database, converting expired certificates to "expired" status, which replaces the previous "revoked" or "not revoked" status.

(OpenSSL is not the best documented of software packages, especially for the command-line tools. Source code reading is often necessary.)

  • 2
    Thanks for your tip on source code reading. But -updatedb only changes valid to expired, so i still don't know what to do to exclude expired certificates from the CRL. Jul 9, 2013 at 11:51

I don't see any reason why you couldn't manually delete them and remove any record of them having been created. I'm not sure if there is an automatic way or not. The point of keeping a listing of them is that someone needs to be able to check if the certificate is valid. If they have a valid date, then they will know that it isn't valid anymore regardless of if it had been revoked prior to expiration. The one thing that leaving it in the CRL would do is that someone with a bad clock would still know that it was expired as long as they could actually get ahold of the CRL.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .