Hierarchical certification authorities and CRLs

Question

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or only a few at the upper levels of the hierarchy?

Answer 1

Each CA will need to publish its own CA.

The reason that it's not possible from a technical perspective to combine multiple CRLs is that each CRL needs to be cryptographically signed by the CA that generated it, so it's a 1-CA-to-1-CRL relationship.