About CRLs
Chapter 15
Revocation and CRLs
577
CRL Issuing Points
Because CRLs can grow very large, several methods have been developed to minimize the
overhead of retrieving and delivering large CRLs. One of these methods is based on
partitioning the entire certificate space and associating a separate CRL with every partition.
This partition is called a
CRL issuing point
—it is the location where a subset of all the
revoked certificates are maintained. Partitioning can be based on whether the revoked
certificate is a CA certificate or end-entity certificate. Each issuing point is identified by its
name.
Once the issuing points have been defined, they can be included in certificates so that an
application that needs to check the revocation status of a certificate can access the CRL
issuing points specified in the certificate instead of the master or main CRL—the
application would check the CRL maintained at the issuing point, which would be smaller
in size compared to the master CRL, and thus speed up the revocation-status-checking
process.
CRL distribution points can be associated with certificates by setting the
CRLDistributionPoint
extension in them.
By default, the Certificate Manager only generates and publishes a single CRL, identified as
the
master CRL
. You can also define an issuing point for CA signing certificates, and an
issuing point that includes all revoked certificate information including expired certificates.
Delta CRLs
You can issue Delta CRLs for any issuing point defined. A delta CRL will contain
information about any certificates revoked since the last update to the full CRL. You set up
Delta CRLs for an issuing point by enabling the
DeltaCRLIndicator
extension.
How CRLs Work
You set up the generation of CRLs by specifying issuing points, configuring those issuing
points, and setting up CRL extensions, if desired.
When the CRL feature is enabled by enabling one or more issuing points, the server collects
revocation information as certificates are revoked. The server attempts to match the revoked
certificate against all issuing points that are set up. A given certificate can match none of the
issuing points, one of the issuing points, several of the issuing points, or all of the issuing
points. When a certificate that has been revoked matches an issuing point, the server stores
the information about the certificate in the cache for that issuing point.
Summary of Contents for CERTIFICATE 7.1 ADMINISTRATOR
Page 1: ...Administrator s Guide Red Hat Certificate System Version7 1 September 2005 ...
Page 22: ...22 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 128: ...Cloning a CA 128 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 368: ...ACL Reference 368 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 460: ...Constraints Reference 460 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 592: ...CRL Extension Reference 592 Red Hat Certificate System Administrator s Guide September 2005 ...
