3

If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or only a few at the upper levels of the hierarchy?

1 Answer 1

6

Each CA will need to publish its own CRL.

The reason that it's not possible from a technical perspective to combine multiple CRLs is that each CRL needs to be cryptographically signed by the CA that generated it, so it's a 1-CA-to-1-CRL relationship.

1
  • 2
    It is quite common to publish all the CRLs to the same website, though - as long as that location is the location specified in the CDP of any issued certificates.
    – TristanK
    Mar 26, 2011 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .