jursyth
I'm a little bit new to the whole CRL process, and so I'm trying to understand it a little bit better. What I think I'm having trouble with is grasping the 'expiration' concept. It appears the default expiration is only 30 days. Why would I want my CRL to only last this long? I would think I would want it to last indefinitely, or until I updated it with the next certificate to add to the revoke list. And if my CRL does expire without being updated, what happens? Can people with 'revoked' certificates then log in again?
Also, on a little bit different topic, why is the CRL process preferred over using the 'disable' directive in a client specific configuration?
Thanks,
J.
