CRL status shows expired

[liyousheng]

The CRL Status is expired, how could I fix it?
Thanks!

[rafall92]

Go to CA Functions > CA Structure & CRLs and click button ot each of your CAs
You can also create service, which will update CRLs for you System Functions > Services. Create new service and set options . Periodical time is depends on your CRLs expiration time

[dga-nagra]

Hi @rafall92,

I have the same issue. I do have a worker service for the renewal and the renewal worked for years.

Yesterday, we had issues with Crypto Tokens secrets (Azure Key Vault) and publishers. The renewal of the CRL failed and we got this issue:

I renewed the secrets but the CRL didn't get renewed for a while so I ran the update manually as mentioned here. Now, the CRL I get is up to date, I can also use certutil on windows to confirm that this is working

Despite that:

• EJBCA still shows the CRL as expired
• I still get the certificate warning

I have no idea what could be wrong here.

[primetomas]

Why do you have a CRL issuer in the CDP in the certificate? The CRL is issued by the same CA as issued the certificate right?
Remove the CRL issuer from the CDP.

[primetomas]

If you enable debug logging (if you use the container debug log instructions are in the dockerhub docs).
https://docs.keyfactor.com/ejbca/latest/enabling-debug-logging
you will be able to see when the service runs with entries like this, followed by a lot of details:

2025-08-05 23:50:55,167+0000 DEBUG [org.ejbca.core.ejb.crl.PublishingCrlSessionBean] (EJB default - 3) Checking to see if CA 'ML-DSA-Sub-G1' (-2113494187) needs CRL generation.