In my application, there are many parties that are trusted to revoke a cert (ie by signing a CRL), but are not trusted to sign (new) certs.

How do I mark a CA to be trusted only for CRLs, and not for certs? Is there a way of marking the CA's cert for this?

How well will applications support this? My intended applications are openssl and strongswan.


If the entity is supposed to sign CRL but not certificates, then it is not a CA -- it is a CRL issuer. It is often called an indirect CRL issuer because, by definition, it is distinct from the CA that issued the certificates whose revocation status is specified by the CRL.

A certificate may be validated as a CA only if (among other things) it has a Basic Constraints extension that contains a cA flag of value TRUE. If you do not want your CRL issuer certificate to be mistaken as a CA certificate, simply make sure that it does not contain the Basic Constraints extension, or, if it contains such an extension, that the cA flag has value FALSE.

To make the certificate acceptable as a CRL issuer, you may have some other things to do:

  • If there is a Key Usage extension, the cRLSign flag shall be set.

  • The CRL should include an Issuing Distribution Point extension with the indirectCRL flag set to TRUE.

  • The CRL issuer name and IDP extension contents shall match those of the CRL Distribution Points extension in the certificates whose status is to be asserted through the CRL. The rules are intricate.

Be warned that indirect CRL are poorly supported. In particular, since the CRL issuer's certificates is not a CA, it is not part of the main certificate chain. As such, it won't be included in, for instance, the sets of certificates sent by SSL clients and servers. Therefore, the indirect CRL will be usable only by systems that are ready to download extra certificates, or have such certificates made available to them through some other method.

  • Excellent response! On OpenSSL based systems, where (or how) would you install the CRL issue's cert? I gather from what you say that you do not install it as a CA. Jun 25 '15 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.