9 ms·
> And a cautious CA might keep revoked certificates in their CRL for more than a year. A CA does need to keep the revoked certificate in the CRL until at least
by WorldMaker 4y ago
> And a cautious CA might keep revoked certificates in their CRL for more than a year.
A CA does need to keep the revoked certificate in the CRL until at least the natural expiration date on the certificate, so for the CAs that give certificates out with 5 years out or more expiration dates, they may need to keep CRLs for much longer than just a year just naturally by nature of their expiration dates.
- tialaramex 4y agoThis CRL rule is about the Web PKI, for which currently policy requires new certificates expire after no more than 398 days. The previous status was the certificates could last up to 825 days, however that policy changed at the end of August 2020, so there are no extant certificates under those rules which expire after this year. And before that the policy was 39 months, but the last such certificate expired in 2021. Before that the policy was 5 years, but that policy changed in 2015 and so such certificates are long expired.