3

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays.

By looking at other root CA certificates installed in browsers, we concluded that we could go without a revocation list for our root CA.

We also based it on the fact that our certificate chain will be installed in strictly firewalled and closed environments on our customer sites, which means retrieving the CRL from our HTTP site won't work.

Is it a bad idea not to include a CRL in the root? And would applications (IIS, IE, Firefox) behave badly or need additional configuration to work right?

I'm aware that by not having CRL's, I lose the ability to revoke a certificate, but this is currently not an issue. The question concerns the root, the subordinate CA would, or could, have a CRL, depending on the Class (Class 1 = production, Class 3 = testing etc.) according to our CP.

3
  • I'm wondering what you gain by not having a CRL though. They're no work to set up and no work to maintain... Nov 10, 2011 at 19:28
  • @MarkHenderson True, but what we are looking to do is provide a chain (Root CA > Subordinate CA 1) for places incapable of reaching our servers, while still having other chains where the Subordinate does have a CRL. Does this make sense?
    – cvaldemar
    Nov 10, 2011 at 20:44
  • Ahh, ok yeah I understand. You did hint at that in your question, I guess I just didn't pick up on it. Nov 10, 2011 at 20:45

1 Answer 1

3

If you're willing to scrap the root CA completely the event that it's used to issue a bad certificate, or an issued certificate is compromised, then it should be no problem.

If the certificate doesn't specify CRL distribution points, then (as far as I'm aware) browsers and other certificate validators should have no qualms about validating the certificate.

Even if an unreachable CDP is specified, browsers are very.. lax about allowing the certificate anyway - this is why the recent certificate authority compromises have prompted OS and browser vendors to issue patches blacklisting the certificates, instead of just trusting browsers to check the CRL properly.

3
  • Thanks for the answer. The Root CA won't have a CRL, but the several of Subordinate CA's will, unless the customer operates in a closed environment then a Sub CA without a CRL would be used. I have read that some software might throw errors if it can't validate the complete chain (for instance signing our Microsoft SubCA using a root with no CRL didn't work without explicitly telling it not to check the chain).
    – cvaldemar
    Nov 10, 2011 at 20:48
  • Do you reckon that we can ignore the unreachable CDP in these closed environments, or would it from a securty point of view be worse, or seem less professional to not include them at all?
    – cvaldemar
    Nov 11, 2011 at 9:21
  • I'd avoid including them at all - some browsers do whine about being unable to check revocation status if there's a CDP advertised, plus they'll have a bunch of failed requests that they might notice in their firewall logs. Nov 11, 2011 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .