Implementing a PKI, Part III: Managing Microsoft Certification Services - Configure CRL’s Distribution Points

(Page 5 of 6 )

Follow the steps provided below to configure the distribution points for CRL:

1. Remove all the CRL distribution locations, except the local CRL distribution point.
   
   DO NOT remove the local CRL distribution point location. The local distribution point is similar to the following path: C:\Windows\System32\CertSrv\CertEnroll\RootCA.crl. The CA uses the local CRL to validate all certificates that are generated before the certificates are issued to users. The local path is not included in the CRL distribution point extension of issued certificates.
   
   
2. On the Extensions tab, in Select Extension, select CRL Distribution Point (CDP).
   
   
3. In Specify Location from which users can obtain a CRL, select one by one the CRL distribution locations (except the local location), click Remove, and then click Yes.
   
   After you remove the locations, the remaining list of CRL distribution points will be similar to the following figure.
   
   
   
   
4. Next, you have to specify the distribution locations (HTTP or LDAP) you are going to use for the CRL publication. It’s best to use an HTTP location when it’s critical not to have any latencies or when clients are not joined in an Active Directory; HTTP locations generally do not replicate and do not have latency issues, whereas an LDAP distribution point might be located in a distributed directory service, like Active Directory.
   
   Click Add, and in Location give the CRL distribution location, and then click OK. Repeat for each type of access protocol if you wish to support more than one protocol.
   
   
5. Now you must configure some more properties about the CRL publishing. The properties must be set for every CRL distribution point path.

• Select a path one-by-one.
  
  
• For each path, and while on the Properties tab, select or clear the check box that is listed in the previous table, depending on the type of path, and then click Apply.

Table: CRL Distribution Point Properties

Next: Configure AIA Distribution Points >>
 

More Windows Security Articles
More By Eliana Stavrou

Comments On: Implementing a PKI, Part III: Managing Microsoft Certification Services

>>> Be the FIRST to comment on this article!