crlType

Specifies whether to create a complete or partitioned CRL. This setting determines the maximum number of certificates that the certificate authority can issue and revoke. For more information, see privateca/latest/userguide/pca.html#limits_pca.

• COMPLETE - The default setting. Amazon Web Services Private CA maintains a single CRL file for all unexpired certificates issued by a CA that have been revoked for any reason. Each certificate that Amazon Web Services Private CA issues is bound to a specific CRL through its CRL distribution point (CDP) extension, defined in RFC 5280.

• PARTITIONED - Compared to complete CRLs, partitioned CRLs dramatically increase the number of certificates your private CA can issue. When using partitioned CRLs, you must validate that the CRL's associated issuing distribution point (IDP) URI matches the certificate's CDP URI to ensure the right CRL has been fetched. Amazon Web Services Private CA marks the IDP extension as critical, which your client must be able to process.