I got a question which i'm unable to find an answer for on any official MS ressource. Image a CA with realy short lifing CRLs (like 1 day). The CA is used only for two purposes: creating NPS certificates for a NPS server and computer certificates for a small bunch of computers which authenticate on WiFi using EAP-TLS. We're using the short lifing CRLs so a OSCP Server is not needed.
The CRLs are distributed internally (meaning: inside the corp network) only using LDAP and HTTP.
Is my assumption right, that a client which wasn't attached to the network for more then 1 day + CRL renewal period would be unable to authenticate against the WiFi without certificate errors?
AFAIK, when connecting to the WiFi, the client would try to check its own and also the NPS certificate of the NPS server which it's using to auth in WiFi. While checking, one step is to check the CRL status. The frist step here it to look up the cached CRL IF it's still valid. However: since the client was absent from network for more then 1 day and "missed" to update the CRL, the cached CRL is invalid. Thus the client would try to update it's CRL using the only internally availible LDAP / HTTP CRL DPs. But because we're not on the network yet, this would fail. Even OSCP would be no help here, since at this point in time we have no network at all and thus also no public network which could be used for hosting a OSCP server.
Since the cached CRL is not valid and a new CRL is unable to be downloaded, the certificate check of the own and the NPS server certificate would fail on the local client, resulting in either: a. no network connection at all b. a certificate warning which prompts the user
Question: Is my assumtion right and how does one handle this szenario in RL?