ayi With offline CAs you still have to publish the root ca CrL, there is an expiration date usually 6 months or a year or so.
