Does CVS cache CRLs? in RSA Certificate Verification Server 1.0
3 years ago
Originally Published: 2004-10-05
Article Number
000058252
Applies To
RSA Keon Certificate Verification Server 1.0
Sun Solaris
Issue
Does CVS cache CRLs? in RSA Certificate Verification Server 1.0
Caching behavior of CVS
Cause
A CA issues multiple CRLs to prevent CRL size from growing. For example:

department X CA issues end-entity certificates for users in department Y and users in department Z.

End-entity certificate for user in department Y has a CRL Distribution point for department Y.

End-entity certificate for user in department Z has a CRL Distribution point for department Z.

The CRL for validating end-entity certificates for users in department Y has an issuing Distribution Point for department Y.

The CRL for validating end-entity certificates for users in department Z has an issuing Distribution Point for department Z.

With this configuration, the question arises: Does CVS cache CRL for department Y and for department Z?
Resolution
RSA Keon Certificate Verification Server 1.0 does cache RLs per DN value specified in an IDP extension. Or as a direct answer, "Yes".