I am setting up my own PKI, and I came across a question to which I couldn't find an answer.

I want to specify CRLDistributionPoints in my server certificates but I am curious whether to use the same URL as I did for the CA or use a separate one for every server certificate. What is "best practice"/reasonable? I don't understand CRLs.


Each CA certificate is supposed to have one and only one CRL. It is serialized and signed with that CA certificate, and each subsequent serial number supersedes previous ones. However, items should not be removed from it ever. I don't believe behaviour is defined where a CA maintains multiple concurrent CRLs.

That said, as a CA, you may (must) maintain a separate CRL for each CA certificate (subordinate or otherwise).

The reason for multiple crlDistributionPoints is to allow you to increase reliability by giving multiple URLs. This isn't really necessary because there are many different ways to provide reliability, but it can be helpful I am sure in some scenarios.

| improve this answer | |

A CA may have multiple CRLs. The common reasons are

  1. different CRLs for CA certificate and end entity certificates
  2. different CRLs for different revocation reasons
  3. internal scope like the geographical locations

For simplicity, most CAs manage only one CRL (e.g. Apple CA), while GoDaddy manages 15 CRLs for its G2 CA.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.