Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently setting up a PKI for my company and while I have come up with a good layout and planned the overall policy of certificate issuance, I'm still puzzled by what role the CRL plays.

By looking at other root CA certificates installed in browsers, we concluded that we could go without a revocation list for our root CA.

We also based it on the fact that our certificate chain will be installed in strictly firewalled and closed environments on our customer sites, which means retrieving the CRL from our HTTP site won't work.

Is it a bad idea not to include a CRL in the root? And would applications (IIS, IE, Firefox) behave badly or need additional configuration to work right?

I'm aware that by not having CRL's, I lose the ability to revoke a certificate, but this is currently not an issue. The question concerns the root, the subordinate CA would, or could, have a CRL, depending on the Class (Class 1 = production, Class 3 = testing etc.) according to our CP.

share|improve this question
I'm wondering what you gain by not having a CRL though. They're no work to set up and no work to maintain... – Mark Henderson Nov 10 '11 at 19:28
@MarkHenderson True, but what we are looking to do is provide a chain (Root CA > Subordinate CA 1) for places incapable of reaching our servers, while still having other chains where the Subordinate does have a CRL. Does this make sense? – cvaldemar Nov 10 '11 at 20:44
Ahh, ok yeah I understand. You did hint at that in your question, I guess I just didn't pick up on it. – Mark Henderson Nov 10 '11 at 20:45
up vote 2 down vote accepted

If you're willing to scrap the root CA completely the event that it's used to issue a bad certificate, or an issued certificate is compromised, then it should be no problem.

If the certificate doesn't specify CRL distribution points, then (as far as I'm aware) browsers and other certificate validators should have no qualms about validating the certificate.

Even if an unreachable CDP is specified, browsers are very.. lax about allowing the certificate anyway - this is why the recent certificate authority compromises have prompted OS and browser vendors to issue patches blacklisting the certificates, instead of just trusting browsers to check the CRL properly.

share|improve this answer
Thanks for the answer. The Root CA won't have a CRL, but the several of Subordinate CA's will, unless the customer operates in a closed environment then a Sub CA without a CRL would be used. I have read that some software might throw errors if it can't validate the complete chain (for instance signing our Microsoft SubCA using a root with no CRL didn't work without explicitly telling it not to check the chain). – cvaldemar Nov 10 '11 at 20:48
Do you reckon that we can ignore the unreachable CDP in these closed environments, or would it from a securty point of view be worse, or seem less professional to not include them at all? – cvaldemar Nov 11 '11 at 9:21
I'd avoid including them at all - some browsers do whine about being unable to check revocation status if there's a CDP advertised, plus they'll have a bunch of failed requests that they might notice in their firewall logs. – Shane Madden Nov 11 '11 at 15:53
Thanks Shane. I'm accepting this answer. – cvaldemar Nov 16 '11 at 19:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.