If I implement a PKI with multiple levels of CAs, do I need to have a CRL for each individual CA or can I just have one CRL for the entire hierarchy (i.e. point all certificates to a single CRL), or only a few at the upper levels of the hierarchy?
SnapOverflow
Each CA will need to publish its own CRL.
The reason that it's not possible from a technical perspective to combine multiple CRLs is that each CRL needs to be cryptographically signed by the CA that generated it, so it's a 1-CA-to-1-CRL relationship.