Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new with ADCS, and there is a lot to understand. I set up a 2-tier PKI, and have placed the offline root CA certificate (CRT) and CRL files on a web server pointing to with a CNAME in DNS. When I configured the CDP and AIA extensons for certs issued from the root, I hard-coded the full http URL, including the CRL /CRT file names. For example http://cdp.mydomain.com/CertEnroll/myrootca.crl

Now I am wondering how bad a choice that was. I did not use any substitution variables.

The root CA is not going to be using delta CRLs, so I am thinking the CRL file name will not change, and can be replaced with the same file name every time it is renewed. Is this correct? As for the AIA extension, I did not check to include it in issued certs, since we don't plan to issue or use certs with non-domain machines. I am thinking domain machines will find the root certificate in AD, or via Group Policy anyway.

If it turns out these hard URL paths are a problem, Is it possible to update them now, and the next time I renew my issuing CA's cert from the root it will have the updated dynamic CDP at that point?

share|improve this question
    
What certs were issued from the root - it should have been just the subordinate CA, right? –  Shane Madden Jul 22 '13 at 5:19

1 Answer 1

up vote 2 down vote accepted

You should not have problems. Your configuration just mean that your CRL file should be called myrootca.crl. As long as it stays updated and persists it's name, clients successfully can check it.
You can not change CDP extension for already issued certificates. But if you will change URL of CDP point, all new certificates from that moment will perform revocation check using new URL. After changing CDP URL you need to ensure that CRL will be published also to the old URL with myrootca.crl name, so old certificates could perform revocation check too.
Also be sure that your CDP list is not enclude more than two CDP points, because in this case revocation check will faile due a timeout.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.