Partitioning certificate revocation lists
Certificates issued by a CA are distributed across multiple CRLs. Each certificate issued by the CA is assigned to a specific CRL, and the address of that CRL is written to the appropriate field of the certificate, such that an authenticating application can subsequently determine if the certificate is revoked. When the CA revokes a specific one of the issued certificates, it determines to which CRL the revoked certificate is assigned, and updates the specific CRL accordingly. In some embodiments, a single one of the multiple CRLs is active for assignment of certificates at any given time, and each certificate issued by the CA is assigned to the currently active CRL. In other embodiments, assignments of issued certificates are distributed between different ones of a pre-determined number of multiple CRLs by applying a statistical distribution formula to each issued certificate to determine a corresponding target CRL.
1. A computer implemented method for managing certificate revocation list (CRL) size by distributing digital certificates issued by a certificate authority (CA) across a plurality of different CRLs based on a time at which the digital certificates are generated, the method comprising:
generating over a first period of time, using one or more computing devices associated with the CA, a first plurality of digital certificates, wherein each of the first plurality of digital certificates includes a first CRL address, wherein the first CRL address indicates a location of a first CRL, and wherein the first CRL is configured to include a first list of revoked digital certificates that identifies one or more of the first plurality of digital certificates that were generated during the first period of time;
obtaining, using the one or more computing devices, an estimated revocation percentage for the first plurality of digital certificates, wherein the estimated revocation percentage is determined prior to a digital certificate of the first plurality of digital certificates being revoked;
updating the estimated revocation percentage based on a revocation of one or more digital certificates of the first plurality of digital certificates;
generating an estimated revocation number based at least in part on the updated estimated revocation percentage and a number of digital certificates of the first plurality of digital certificates;
determining, using the one or more computing devices, to stop generating digital certificates that include the first CRL address based at least in part on the estimated revocation number satisfying a threshold number; and
based on the determining to stop generating certificates that include the first CRL address, generating over a second period of time that is different from the first period of time, using the one or more computing devices, a second plurality of digital certificates, wherein each of the second plurality of digital certificates includes a second CRL address, wherein the second CRL address indicates a location of a second CRL, wherein the second CRL is configured to include a second list of revoked digital certificates that identifies one or more of the second plurality of digital certificates that were generated during the second period of time,
wherein in response to revocation of a first digital certificate of the first plurality of digital certificates, an indication of the first digital certificate is added to the first list of revoked digital certificates of the first CRL based at least in part on the time at which the first digital certificate was generated, and
wherein in response to revocation of a second digital certificate of the second plurality of digital certificates, an indication of the second digital certificate is added to the second list of revoked digital certificates of the second CRL based at least in part on the time at which the second digital certificate was generated.
2. The computer implemented method of claim 1 , further comprising revoking, using the one or more computing devices, a second digital certificate of the first plurality of digital certificates, wherein said revoking includes updating the first list of revoked digital certificates of the first CRL to include an indication of the second digital certificate of the first plurality of digital certificates.
3. The computer implemented method of claim 1 , wherein the CA is associated with a plurality of CRLs that includes the first CRL, wherein over the first period of time the first CRL is active for assignment of digital certificates and during the first period of time all other CRLs of the plurality of CRLs are inactive for assignment of digital certificates.
4. The computer implemented method of claim 3 , wherein the second CRL is created after an expiration of the first period of time.
5. The computer implemented method of claim 1 , wherein the CA is associated with a plurality of CRLs that includes the first CRL and the second CRL, wherein over the second period of time the second CRL is active for assignment of digital certificates and during the second period of time all other CRLs of the plurality of CRLs are inactive for assignment of digital certificates.
6. The computer implemented method of claim 1 , wherein said generating the first plurality of digital certificates comprises assigning the first CRL address to each of the first plurality of digital certificates, wherein said generating the second plurality of digital certificates comprises assigning the second CRL address to each of the second plurality of digital certificates.
7. The computer implemented method of claim 1 , wherein the second period of time occurs after an expiration of the first period of time.
8. A non-transitory computer readable medium for managing certificate revocation list (CRL) size by distributing digital certificates issued by a certificate authority (CA) across a plurality of different CRLs based on a time at which the digital certificates are generated, the non-transitory computer readable medium storing computer executable instructions that, when loaded into computer memory and executed by a processor of a computing device, cause the computing device to perform steps, the steps including:
generating over a first period of time, using one or more computing devices associated with the CA, a first plurality of digital certificates, wherein each of the first plurality of digital certificates includes a first CRL address, wherein the first CRL address indicates a location of a first CRL, and wherein the first CRL is configured to include a first list of revoked digital certificates that identifies one or more of the first plurality of digital certificates that were generated during the first period of time;
obtaining, using the one or more computing devices, an estimated revocation percentage for the first plurality of digital certificates, wherein the estimated revocation percentage is determined prior to a digital certificate of the first plurality of digital certificates being revoked;
updating the estimated revocation percentage based on a revocation of one or more digital certificates of the first plurality of digital certificates;
generating an estimated revocation number based at least in part on the updated estimated revocation percentage and a number of digital certificates of the first plurality of digital certificates;
determining, using the one or more computing devices, to stop generating digital certificates that include the first CRL address based at least in part on the estimated revocation number satisfying a threshold number; and
based on the determining to stop generating certificates that include the first CRL address, generating over a second period of time that is different from the first period of time, using the one or more computing devices, a second plurality of digital certificates, wherein each of the second plurality of digital certificates includes a second CRL address, wherein the second CRL address indicates a location of a second CRL, wherein the second CRL is configured to include a second list of revoked digital certificates that identifies one or more of the second plurality of digital certificates that were generated during the second period of time,
wherein in response to revocation of a first digital certificate of the first plurality of digital certificates, an indication of the first digital certificate is added to the first list of revoked digital certificates of the first CRL based at least in part on the time at which the first digital certificate was generated, and
wherein in response to revocation of a second digital certificate of the second plurality of digital certificates, an indication of the second digital certificate is added to the second list of revoked digital certificates of the second CRL based at least in part on the time at which the second digital certificate was generated.
9. The non-transitory computer readable medium of claim 8 , wherein the steps further include:
revoking, using the one or more computing devices, a second digital certificate of the first plurality of digital certificates, wherein said revoking includes updating the first list of revoked digital certificates of the first CRL to include an indication of the second digital certificate of the first plurality of digital certificates.
10. The non-transitory computer readable medium of claim 8 , wherein the CA is associated with a plurality of CRLs that includes the first CRL, wherein over the first period of time the first CRL is active for assignment of digital certificates and during the first period of time all other CRLs of the plurality of CRLs are inactive for assignment of digital certificates.
11. The non-transitory computer readable medium of claim 10 , wherein the second CRL is created after an expiration of the first period of time.
12. The non-transitory computer readable medium of claim 8 , wherein the CA is associated with a plurality of CRLs that includes the first CRL and the second CRL, wherein over the second period of time the second CRL is active for assignment of digital certificates and during the second period of time all other CRLs of the plurality of CRLs are inactive for assignment of digital certificates.
13. The non-transitory computer readable medium of claim 8 , wherein said generating the first plurality of digital certificates comprises assigning the first CRL address to each of the first plurality of digital certificates, wherein said generating the second plurality of digital certificates comprises assigning the second CRL address to each of the second plurality of digital certificates.
14. The non-transitory computer readable medium of claim 8 , wherein the second period of time occurs after an expiration of the first period of time.