On ‘names are hard’, X509 Distinguished Names (DN) can be a downright minefield.
Consider military (gov) where rank is part of the distinguished name field.
So what happens when someone gets a pay raise (get’s promoted)?
Each time that happens the DN changes which means... https://t.co/ViY8wgRTsV
The old certificate needs to be revoked.
Onto the certificate revocation list it goes...
New digital certificates are issued, access cards re-provisioned, CAs updated (and eventually synchronized).
Life goes on...
But what happens to the certificate revocation list (CRL)?
According to Wikipedia there were over 17 million Common Access Cards issued by 2008.
That’s a decade ago and there are ~1.4 million people in the US military this year alone (according to Google). Don’t forget that we’re talking about a lot more than just military people...