I am generating a CA for internal use. When generating a CA, the best practice I have observed is to keep the root CA offline and emit an intermediate CA certificate that will in turn emit the end-user certificates. This way, a compromise of the intermediate CA key can be recovered by revoking that intermediate CA and generating a new one.
I see, however, CRL files need to be renewed regularly (eg. daily), which would require the root CA keys to be used. But the main goal of all this is to keep the CA keys offline. What is the best practice here?
Is there the possibility of using a separate key for CRL signing? If so, how would I do this? Question is not OpenSSL-specific but I'm using OpenSSL in case you want to provide examples.