up vote 0 down vote favorite
share [g+] share [fb]

What benefit is there in using the LDAP distribution point for an offline CA versus using only HTTP? It sounds like the process would be much simpler to use the HTTP distribution point only. I've spent quite a bit of time researching this issue with no definitive answer.

EDIT - I have a heterogeneous environment. The way I understand it I will need to have the distribution point available via HTTP for unauthenticated access from my embedded devices and Linux clients. That being the case what is the advantage to adding the CRL to AD as well?

link|improve this question
93% accept rate
2  
Why simpler, if you've got Active Directory already? A certutil -crl will handle your publish still, and save you needing an HTTP server hosting the file. Choose what makes the most sense for your environment, but in some cases there are definitely advantages to the LDAP CDP. – Shane Madden Dec 5 '11 at 20:51
@ShaneMadden - thanks. Between you and Paul I'm good. – Tim Brigham Dec 5 '11 at 20:59
feedback

1 Answer

up vote 2 down vote accepted

LDAP dist points are nice because you don't have to worry about replication and you will likely have multiple DC's and, therefore multiple backup servers. Obviously this is only helpful with an internal PKI. If you need to get there externally, http or better yet OCSP are better options.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.