I have a website running in Windows Server 2012, IIS. User's are authenticated using client certificates.
I used to issue client certificates using Certificate Authority MMC snap-in.
Since the number of users is growing rapidly, I am now creating client certificates in batch, using the BouncyCastle library and a little C# code. I believe that I could also have done this using Makecert or Openssl.
In these certificates I am setting the revocation list entries to the same values that the Certificate Authority snap-in uses.
IIS accepts these certificates just fine.
My question relates to certificate revocation. The client certificates that were issued on the server can easily be revoked, using the MMC snap-in, but suppose I need to revoke any of these new certificates. Although IIS accepts these certificates, it does not have any record of them, so apparently I can't revoke them using the Certificate Authority snap-in. Furthermore, there appears to be no way to import these certificates, making them show up in the Certificate Authority snap-in.
So what is the best way to go about this? Do I need to setup a revocation list (CRL) somewhere else for these certificates?