I'm configuring a PKI infrastructure with an offline root CA and several issuing CAs. Among other topics, I'm struggling to decide how the revokation of an Issuing CA certificate works.

My Root CA will issue CRL once a year, and as far as I know, a machine with a CRL cached won't download a new CRL until the current one expires. But, what happens if let's say, the current CRL expires in November 2016, but the Root CA revoke an Issuing CA certificate in January 2016? Does this mean that a machine will trust the Issuing CA certificate until November 2016 although it's been already revoked by the Root CA? Is there a way to force the update of the cached CRL?

Thank you!


closed as off-topic by cygnusv, DrLecter, poncho, CodesInChaos, bob Jun 18 '15 at 18:31

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about security policies that may be based on cryptography (as opposed to the design of cryptographic algorithms and protocols) are off-topic here, but may be asked on Security." – cygnusv, DrLecter, poncho, CodesInChaos, bob
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    $\begingroup$ This question clearly belongs to Security.SE $\endgroup$ – cygnusv Jun 18 '15 at 9:26

Browse other questions tagged or ask your own question.