If the entity is supposed to sign CRL but not certificates, then it is not a CA -- it is a CRL issuer. It is often called an indirect CRL issuer because, by definition, it is distinct from the CA that issued the certificates whose revocation status is specified by the CRL.
A certificate may be validated as a CA only if (among other things) it has a
Basic Constraints extension that contains a
cA flag of value
TRUE. If you do not want your CRL issuer certificate to be mistaken as a CA certificate, simply make sure that it does not contain the
Basic Constraints extension, or, if it contains such an extension, that the
cA flag has value
To make the certificate acceptable as a CRL issuer, you may have some other things to do:
If there is a
Key Usage extension, the
cRLSign flag shall be set.
The CRL should include an
Issuing Distribution Point extension with the
indirectCRL flag set to
The CRL issuer name and IDP extension contents shall match those of the
CRL Distribution Points extension in the certificates whose status is to be asserted through the CRL. The rules are intricate.
Be warned that indirect CRL are poorly supported. In particular, since the CRL issuer's certificates is not a CA, it is not part of the main certificate chain. As such, it won't be included in, for instance, the sets of certificates sent by SSL clients and servers. Therefore, the indirect CRL will be usable only by systems that are ready to download extra certificates, or have such certificates made available to them through some other method.