A CA based model of validation fails as it is not capable of performing revocation of itself; there is no trust agility when a Root CA is compromised, as you have to replace your trust anchor. If this is merely an issuing CA rather than a root, the revocation event can succeed. However, let's review basic approaches to validation:
- Certificate Revocation Lists - a blacklist of revoked certificates
distributed as a file. Large CRLs are difficult to consume and cause
OCSP without Nonce - a repeatable response can be mass produced and
cached. Small, fast and efficient.
OCSP with Nonce - an OCSP request and response that includes a
cryptographic nonce; Nonced OCSP is always live. Small, fast, but
introducing slightly more of a performance hit than a vanilla OCSP
OCSP was previously more oriented towards being a live version of CRLs, a blacklist. However, the newest RFCs for OCSP also enable use of OCSP as a whitelist too. Combined blacklist and whitelist approaches for validation are far more secure.
When thinking about validation, keep in mind that you can, and should consider other alternatives to CA based trust models, particularly for larger networks or networks where the possibility of CA compromise, or flexibility, is needed.
If given the choice between producing CRLs, OCSP, or both, I always plan to utilize a both model, with preference given to fail-closed OCSP, supplemented by CRLs. In general I prefer VA based validation schemes, since they have the ability to revoke compromised CAs.
Now that I've written all this, am going to answer your questions
CRL based validation should almost always be less preferred than OCSP based validation
CRLs can be purged from an IT product, e.g. on Windows
certutil -setreg chain\ChainCacheResyncFiletime @now