I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration.
In my case, the root certificate of CA is used to verify client identities, id est user must present a valid certificate and private key to access specific web pages (Apache
VerifyClient require or Nginx
ssl_verify_client on). If a user leaves the company or his/her private key is compromised, the certificate is added to CRL.
As we can see, the CRL will grow longer and longer as employees come and go. This is not what I want. However, as every certificate has an expiration date (I set it to 180 days), can I remove expired certificates from the CRL? This can somewhat reduce the issue with over-sized CRL.
Wikipedia article on "CRL" says that expiration should not be used as a substitution of revocation. I think they are talking about web browsers verifying web servers, as some users' computer may have incorrect time (thus trusting the expired certificates provided by web servers). However in my case, it is the web server that verifies users, so if I can ensure that the time on the web server is correct, can I remove those expired compromised certificates from CRL?