about Intermediate CA CRLs

["Enrique Velasco" <enrique.velasco@xxxxxxxxxx>]

Should an Intermediate CA Certificate include the CRL Distribution Point
Extension?

One might want to revoke an Intermediate CA Certificate if there's a key
compromise, therefore publishing a CRL, but that would be completely useless
if no one's checking it, so my first answer to my own question would be YES.

Then I wonder how can this be done, as the Root CA key should be off-line,
as recommended.

I've noticed that only a few Intermediate CA Certificates include a CRL
Distribution point, and those CRL are valid for several months. So I Imagine
that issuing such CRL must be a manual (i.e.. not automated) process, done
only when there is the urge to revoke the Intermediate CA Certificate.

Any thoughts?

again,

Should an Intermediate CA Certificate include the CRL Distribution Point
Extension?
and how can this be done?


	Enrique Velasco
	Acepta.com