I'm configuring a PKI infrastructure with an offline root CA and several issuing CAs. Among other topics, I'm struggling to decide how the revokation of an Issuing CA certificate works.
My Root CA will issue CRL once a year, and as far as I know, a machine with a CRL cached won't download a new CRL until the current one expires. But, what happens if let's say, the current CRL expires in November 2016, but the Root CA revoke an Issuing CA certificate in January 2016? Does this mean that a machine will trust the Issuing CA certificate until November 2016 although it's been already revoked by the Root CA? Is there a way to force the update of the cached CRL?