Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I installed 3 CA's in lab environment:

  1. SA Root CA
  2. SA Intermediate CA
  3. Enterprise CA (also DC)

The instructor recommends taking Root and Intermediate CA's offline once the Enterprise CA has been issued it's certificate. I took Root and Intermediate CA's offline and now the Enterprise CA's certificate cannot be verified because both Root and Intermediate CA's are in the chain of trust and are unavailible.

To overcome that I thought to publish the CRL's to a shared folder on a server that is always availible, but CRL's are valid only for a week. That means I have to bring both Root and Intermediate CA's up every week to publish CRL's?

What is the commonly proposed solution to such scenario?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You are aware you can publish the CRL to Active DIrectory and then with a longer duration?

http://networkerslog.blogspot.com/2010/12/publish-offline-certificates-and-crls.html

And then I would put the validity higher - obviously. Otherwise it is too much work to republish the CRL's.

share|improve this answer
    
I'll try that in my project, thanks –  Dean Apr 29 '12 at 11:59
    
But theoreticaly, is it possible to publish to share on another server? –  Dean Apr 29 '12 at 12:00
1  
Sure. THis is fully documented - in the documentation. THat even makes often sense, for example when your inner CA is not public but you want the revocation list on the internet. –  TomTom Apr 29 '12 at 14:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.