3

How can I reset local CRL (in OS local cash) in Windows OS (XP, Windows 7) manual? We need to reset local CRL because otherwise the OS will use local CRL until "next update" period.

As described in "Manually publish the CRL":

Clients that have a cached copy of the previously-published CRL or delta CRL will continue using it until its validity period has expired, even though a new CRL has been published. Manually publishing a CRL does not affect cached copies of CRLs that are still valid; it only makes a new CRL available for systems that do not have a valid CRL.

4
  • I don't understand the question. Here is a very good white paper that explains Certificate Revocation technet.microsoft.com/en-us/library/bb457027.aspx Jun 22, 2011 at 14:46
  • Do you want new certificates to use an AD Crl Distribution Point instead of a file Crl Distribution Point or do you want to update the CRL on an existing file Crl Distribution Point? Jun 22, 2011 at 14:49
  • @Mark Arnott the link you provided, describe the certificate revocation behavior, but in my case I want to reset the local cash for the the CRL. When OS verify the revocation status it load CRL from Crl Distribution Point in user certificate and CASH the CRL until "Next update" period in CRL.
    – Sasha
    Jun 23, 2011 at 15:12
  • @Mark Arnot If I want to force the OS to load the new CRL before "Next update" period I need to reset the local CRL.
    – Sasha
    Jun 23, 2011 at 15:14

2 Answers 2

4

From the “How Certificate Revocation Works” article:

certutil -urlcache crl delete

But there is a warning:

It may be necessary to restart the application or even the computer in order to flush the CRL cache in Windows XP or Windows Server 2003.

Apparently this command and other variations of it clears just the disk cache, but CRLs may also be cached in memory, so a restart of some services might be required.

For Windows Vista (and presumably 7) a better method is suggested, which should also clear CRLs cached in memory:

certutil -setreg chain\ChainCacheResyncFiletime @now
1

This command must be run both on the Domain Controller and the client machine.
On the domain controller run:

certutil -setreg chain\ChainCacheResyncFiletime @now
net stop certsvc
net start certsvc

On the client machine run:

certutil -setreg chain\ChainCacheResyncFiletime @now 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .