1 Answer
- Newest
- Most votes
- Most comments
0
Hi,
Yes. AWS Private Certificate Authority (CA) supports indirect CRLs. To use indirect CRLs with AWS Private CA, you can specify one or more CDPs when creating the CRL. The CDPs can be specified as URLs or DNS names in the CRL Distribution Points extension of the CA certificate. Refer here for more details: https://docs.aws.amazon.com/privateca/latest/userguide/ca-lifecycle.html
Thanks Arun
answered 2 years ago
Relevant content
- asked 2 years ago
AWS OFFICIALUpdated 5 months ago- AWS OFFICIALUpdated 3 months ago
- AWS OFFICIALUpdated 2 months ago
Hi Arun, that link doesn't mention anything about configuring CDPs or indirect CRLs. I understand that it's probably possible to generate certificates with custom CDPs. My question is about whether or not AWS PCA supports the management of indirect CRLs. In other words, does PCA have the ability to automatically sign a CRL with a CA different than the issuing CA?
hi Dani, ACM PCA currently doesn't support automatic signing of CRL's with a different CA than the issuing CA. If you want to sign the CRL with a different CA, you will have to sign the CRL and then distribute it to the appropriate parties. Alternatively, you could configure the issuing CA to issue the CRL as and indirect CRL, where the CRL has a reference to another CRL issued by a different CA