I'm trying to set up a basic OpenSSL two-tier PKI but I'm not understanding how CRLs work in an airgapped RootCA; how can I revoke an IntermediateCA in a way that everyone knows it has been revoked?

We've got a offline root and issuing CA that are still running Sha1 for hashing. They're really only being used for user tokens for authentication so the SHA1 isn't a huge thing. However now I need to ...