Search code examples
certificatecertificate-authoritycertificate-revocation

Revoking an expired certificate


Is revoking an expired certificate a good approach?

An expired certificate is considered an invalid certificate, but it is possible to revoke it. Since it is possible to revoke it, it should be a valid approach by the CA.

Doesn't the CA consider if it is revoked or not and how would it affect the way the certificate is used.


Solution

  • It is a bad idea. No CA do this

    An expired certificate will be rejected in general. A digital-signature signature will be verified as invalid using an expired certificate. Browsers reject SSL connections to sites with expired certificates. There is no need of any additional validation

    In fact, you will cause an inconsistency with existent signatures. To preserve signatures along certificate expiration time, they are protected with a timestamp. When the certificate of the timestamp is close to expire, an additional timestamp can be issued. Long term signature format AdES also embed the revocation evidences of used certificates.

    Revoking an expired certificate means those signatures are valid, but the status of the certificate at CA would be not valid. It has no sense.

    From the point of view of the CA, It is a waste of resources. Think in a 20 years old CA with millions of expired certificates in revoked state. It will need an incredible large CRL file( revocation list) to serve and OCSP Services ( online check status) to maintain