5. Certificate Revocation Lists

TrustView can monitor Certificate Revocation Lists (CRLs), so you’re notified before a CRL you rely on expires and needs to be reissued or refreshed by its issuing CA.

A CRL is published by a Certificate Authority (CA) and lists certificates that have been revoked before their natural expiration date. CRLs are themselves only valid for a limited time (until their next scheduled update), after which relying parties may no longer trust them - so keeping track of a CRL’s own expiry is just as important as tracking certificate expiry.

5.1. Add a CRL to monitor

Click CRLs in the left menu, then Add. The following information is required:

• Name - a name to identify the CRL by

• Origin - the URL the CRL can be downloaded from, e.g. http://crl.domain.dk/ca.crl

• Comment - any comment

Once added, TrustView periodically fetches the CRL from the specified origin and tracks its expiry the same way it tracks certificate expiry, including sending out expiry notifications before the CRL expires.

5.2. Managing a monitored CRL

A monitored CRL’s edit page offers the same monitoring features available on other monitored objects:

• A manual Scan now button, to fetch and parse the CRL immediately instead of waiting for the next scheduled update, plus a scan history showing the results of each past scan.

• Notification recipients/contacts, following the same rules as Notifications.

• A ServiceNow integration, comments, custom fields and document upload, matching the equivalent features on other monitored object types.

• An event log, recording changes made to the CRL.