admin estimate-crl-size

[mcpherrinm]

We might want something like an admin command that processes an incident table, estimating the size of the resulting CRL shards.

[aarongable]

This probably doesn't even need to be part of the admin tool: CRL size is fully determined by number of certs + whether they have a revocation reason code attached. For a mass revocation event there will always be a revocation reason, so this tool can just be "multiply # of affected certs by size of a reason-containing CRLEntry".

[mcpherrinm]

I think my main concern is with sharding, plus the existing size of CRLs. We could happen to have CRL shards that push above whatever our target sizes are due to bad luck, and that might affect our decision making.

[jsha]

The program requirement is a "should":

https://learn.microsoft.com/en-us/security/trusted-root/program-requirements

All issuing CA certificates must contain either a CDP extension with a valid CRL and/or an AIA extension to an OCSP responder. An end-entity certificate may contain either an AIA extension with a valid OCSP URL and/or a CDP extension pointing to a valid HTTP endpoint containing the CRL. If an AIA extension with a valid OCSP URL is NOT included, then the resulting CRL File should be <10MB.

I think if we estimated that most shards would be <10MB, but some would be bigger by chance, that is reasonably in the spirit of that "should".