Implementing a PKI, Part III: Managing Microsoft Certification Services - Certificate Revocation List (CRL) publication
(Page 3 of 6 )
As I stated earlier, when a certificate is cancelled it is added to the CRL. Each certificate includes a CRL distribution point and cannot be modified after a certificate is issued. The CRL distribution point is used by the client programs that use digital certificates in order to specify the validity of the certificate. If a certificate’s serial number is included within the CRL, then the client marks the certificate as invalid. Doing so, you cannot use a revoked certificate for signing or encrypting any messages. However, you can use it for decryption.
A CRL is automatically published after a specified period of time. You may set the CRL’s publication interval by right-clicking on the Revoked Certificates folder, selecting Properties, and on the CRL Publishing Parameters window setting the publication interval. It is recommended that you set the publishing period between 90 and 180 days, because revocation of a certificate is usually a rare operation.
As long as the client program has a valid CRL in its local cache, it will not attempt to retrieve another CRL from the CA which publishes it. However, if a CRL is absent or is not updated, the client program could not use the certificate because it cannot verify its status.
In addition, you may use the CRL Publishing wizard to manually publish a CRL before the scheduled publication period. However, client programs that have a cached copy of a valid CRL will continue using it until its expiration period, even though a new CRL has been published. The client program will use the new CRL after the expiration of the first one.
If you need to set the new CRL in effect immediately, you must open Internet Explorer and select Internet Options -> Content tab -> Clear SSL State, in order to remove all client authentication certificates from the Secure Sockets Layer (SSL) cache.
Next: Configure Root CA Certificate Properties >>
More Windows Security Articles
More By Eliana Stavrou
/ 12 
