I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration.
In my case, the root certificate of CA is used to verify client identities, id est user must present a valid certificate and private key to access specific web pages (Apache VerifyClient require
or Nginx ssl_verify_client on
). If a user leaves the company or his/her private key is compromised, the certificate is added to CRL.
As we can see, the CRL will grow longer and longer as employees come and go. This is not what I want. However, as every certificate has an expiration date (I set it to 180 days), can I remove expired certificates from the CRL? This can somewhat reduce the issue with over-sized CRL.
Wikipedia article on "CRL" says that expiration should not be used as a substitution of revocation. I think they are talking about web browsers verifying web servers, as some users' computer may have incorrect time (thus trusting the expired certificates provided by web servers). However in my case, it is the web server that verifies users, so if I can ensure that the time on the web server is correct, can I remove those expired compromised certificates from CRL?
openssl crl
I can see "Last Update" and "Next Update", is this what you mean "CRL expiration date"? Aren't they just meant to tell clients how frequent should they "check for updates"?