we want to use openssl lib in our communications with certificates for mutual authentication. we have setup a CA, with subca and certificates for clients & server. upon connection it is easy to check the certificate validity: starting date, expiration date, signature, CRL.
but let say the communication once establish drag on and one of the certificates expires, should the communication be closed ?
What if a certificate becomes compromised ? we will have the CRL updated, should we check the CRL for every packet ?
Checking the expiration date should be fairly fast, so could be ok to do on every read/write.
Checking the CRL is a bit more involved and I think could slow down communication a lot. this is why I wonder what should be done ?
some of our certificates can last for a year, which could means that CRL could grow a lot if many certificates becomes compromised!