Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What benefit is there in using the LDAP distribution point for an offline CA versus using only HTTP? It sounds like the process would be much simpler to use the HTTP distribution point only. I've spent quite a bit of time researching this issue with no definitive answer.

EDIT - I have a heterogeneous environment. The way I understand it I will need to have the distribution point available via HTTP for unauthenticated access from my embedded devices and Linux clients. That being the case what is the advantage to adding the CRL to AD as well?

share|improve this question
Why simpler, if you've got Active Directory already? A certutil -crl will handle your publish still, and save you needing an HTTP server hosting the file. Choose what makes the most sense for your environment, but in some cases there are definitely advantages to the LDAP CDP. – Shane Madden Dec 5 '11 at 20:51
@ShaneMadden - thanks. Between you and Paul I'm good. – Tim Brigham Dec 5 '11 at 20:59
up vote 2 down vote accepted

LDAP dist points are nice because you don't have to worry about replication and you will likely have multiple DC's and, therefore multiple backup servers. Obviously this is only helpful with an internal PKI. If you need to get there externally, http or better yet OCSP are better options.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.