CRL Freshness & Drift Monitor

Monitor public X.509 certificate revocation lists (CRLs) for expiry risk, publication changes, issuer/key-identifier drift, and revoked-certificate set changes. The Actor is designed for PKI, identity, infrastructure, and security teams that need a schedule-ready external check of public CRL distribution points.

What it does

For each CRL URL, the Actor:

1. fetches a bounded public HTTP(S) endpoint;
2. parses DER or PEM X.509 CRL data;
3. reports thisUpdate, nextUpdate, issuer, CRL number, delta-CRL indicator, authority key identifier, signature algorithm, and revocation counts;
4. classifies freshness as healthy, expiring, expired, not_yet_valid, or no_next_update;
5. compares the normalized CRL with the prior successful check in a named key-value store; and
6. emits one structured dataset row with initial_snapshot, unchanged, or changed.

Failed fetches, malformed CRLs, issuer mismatches, and oversized CRLs do not replace a known-good baseline and are not charged as successful checks.

Input

{
  "monitorId": "production-pki",
  "targets": [
    {
      "label": "DigiCert Global Root G2 CRL",
      "crlUrl": "http://crl3.digicert.com/DigiCertGlobalRootG2.crl"
    },
    {
      "label": "Corporate issuing CA",
      "crlUrl": "https://pki.example.com/issuing-ca.crl",
      "expectedIssuer": "CN=Example Issuing CA,O=Example Corp,C=US"
    }
  ],
  "warningHours": 72,
  "timeoutSeconds": 30,
  "maxConcurrency": 3
}

Use the same monitorId for scheduled runs that should share history. expectedIssuer is an optional exact RFC 4514 string; omit it until you have copied the issuer value from a successful row.

Output

Important fields include:

• status, crl_health, requirements_status, and update_pattern
• issuer, this_update, next_update, and hours_until_next_update
• crl_number, delta_base_crl_number, and authority_key_identifier
• revoked_certificate_count, revoked_entries_sha256, and reason counts
• added/removed/modified revoked-serial counts and bounded detail
• content_hash, previous_hash, and state_store_mode
• structured change records with review priorities

routine_republication means signed publication metadata changed while the normalized revoked set and issuer/authority identity did not. revoked_set_changed means serial membership or revocation metadata changed. These labels are review aids, not proof that a CA operation is safe or unsafe.

Persistence

The Actor stores successful normalized snapshots in the explicit named key-value store:

crl-freshness-drift-monitor-state-v1

Keys are SHA-256 derivations of monitorId plus crlUrl. The default run-scoped store is not used as cross-run memory.

Pricing behavior

The custom pay-per-event event is crl_check. It is emitted only after a CRL is fetched, parsed, compared, and stored successfully. Errors are written to the dataset without the custom charge.

Security and operating limits

• 1–100 targets; maximum 5 concurrent requests
• public HTTP(S) URLs only; URL credentials and fragments rejected
• standard ports 80/443 only
• private, loopback, link-local, multicast, and reserved destinations blocked
• every redirect destination is resolved and validated; the connection is pinned to a validated address
• maximum 5 redirects and 2 bounded attempts
• compressed HTTP responses rejected
• 6 MB response limit
• maximum 50,000 revoked-certificate entries
• 60-second maximum timeout per target
• failed observations never overwrite a successful baseline

HTTP is supported because many CRL distribution points are intentionally published over HTTP. X.509 CRLs are signed objects, but this Actor does not verify the CRL signature because it does not accept an issuer-certificate trust input. It parses the signed fields and reports signature_verified: false. Use a trusted PKI validator and the issuer certificate when cryptographic authenticity is required.

The Actor does not query LDAP distribution points, OCSP responders, private/internal URLs, or authenticated endpoints. Polling can miss a CRL that changed and reverted between runs. Apify schedules/webhooks provide automation primitives; the Actor is not a complete PKI monitoring or incident-response system.

Local development

python -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt
python smoke_test.py
npx --yes apify-cli validate-schema
npx --yes apify-cli run --purge

Independent product notice

This is an independent monitoring utility. It is not affiliated with, endorsed by, or operated by DigiCert, Microsoft, GlobalSign, any certificate authority, browser vendor, or PKI platform. Public names in examples identify public CRL sources only. Verify material PKI decisions against the CA's official documentation and your organization's trust policy.