This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Hi.
I have internal URLs that use internal certificates.
if my internal Certificate Authority becomes unavailable will my URLs using this CA have problems working?
I plan to create certificates for many years.
Thanks.
Hi @Salves
It will depend on what you mean by not available. If the CA service is just off-line then no, but if the CRL repository is also off-line, then you might see issues for clients that have full revocation checking enabled, if they are unable to download the CRL for the certificates. If they are separate then you should be good.
Gary.
Hi @Gary Reynolds ,
excuse my ignorance.
My knowledge is that I installed the certificate authority service on my domain. I go with this certificate authority to create certificates for my internal sites, that's the goal.
I don't know what CRL you mentioned. Guess it's the renewal period?
When I used it for an exchange server a long time ago, I remember that I needed to distribute this certificate at the domain level so that computers could identify this local certificate.
I want that too, but now it will be for multiple local domain internal URLs.
My question is if this certificate authority server becomes unavailable, if my URLs will continue to work with certificate authority turned off.
I don't know if every time the URL is accessed the client needs to communicate with the certificate authority to validate the SSL communication.
As far as I read the information I found is that once a certificate is generated the verification with the certificate authority will only occur when it expires, but I don't know if this is true.
I also that there are two options in the certificate authority web server template, one that is (period validity) and (renewal period). I didn't understand if when configuring the renewal it will go to the certificate authority and for that it needs to be on. If this is true I want it to renew only at the end of the validity period
Thanks.
Have a look at this article which explains what a CRL is - https://www.techtarget.com/searchsecurity/definition/Certificate-Revocation-List
Depending on you CA configuration the CRL can by published to a website, if this website is on the CA and CA is switched off, then the CRL will not be available and this could cause connection issues.
This article explains what is a CA is https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-certification-authorities
Have a look at this article which explains the traffic flow when a client connects to a URL with SSL\TLS enabled, you will notice that the client doesn't talk to the CA server. - https://www.cloudflare.com/en-au/learning/ssl/what-happens-in-a-tls-handshake/ This article doesn't show the CRL traffic, but if enabled, during the ClientKeyExchange step the client will download the CRL and check if the certificate has been revoked. The location of the CRL is included in the certificate installed on the website.
A client will trust a certificate issued by a CA if the CA's root certificate used to sign the certificate is installed in the client Enterprise Trusted or Trusted Root Certification Authorities. This article explains how to install a root certificate - https://learn.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate
Gary.
Just checking if there's any update or progress on this one?
Hi @Gary Reynolds ,
I'm having some difficulty understanding the CA functions and the CRL in practice.
I read, looked for practical examples but it is confusing for my understanding.
This whole subject is very confusing, I read that depending on the volumetry we need to have several CRLs to support, but I didn't find any clear example of beginning, middle and end explained how all this happens. There are examples but I couldn't understand it yet.
I might be worried about something that is not very important so I mean when I mean attention when my CA server is offline it's for temporary maintenance cases. In cases where it is restarted for a security update for example or some other need that it is necessary to temporarily take it offline.
I think when I do setup my CA and I also found CRL settings to change certificate revoked check times.
I can configure the CA and CRL for years, so in case of offline I won't have any problems until I recover my CA and CRL cervidor. It will all be on the same server.
I have about 100 URLs, but that's a lot of connections we get from users in the millions.
I have three web servers that communicate with each other with these URLs separate from each other for different purposes, but that connect to each other.
My system is critical and cannot stop, it works 24x7 and used public URLs with Digcert public certificates valid for one year.
The difference is that now we will use internal certificates because the application requires an SSL connection, so we need certificates for each URL.
Thanks.
The question is whether I really need to worry about all this.
When I refer to changing the periods, they are these:
If I change to more years, if the CA and CRL become unavailable I believe it could be an alternative.
Hi,
Based on your CRL publishing configuration, I would recommend unticking the delta option and then force the publishing of a new CRL, then wait at least 2 weeks to be on th safe side, before turning off the CA. That way you have a week after the last CRL is published before the CA needs to be switched on again, if you need extra time, you could increase the CRL publication interval to 2 or 3 weeks or as required.
If you still have concerns, then probably it would be best to do some testing of the impact, by switch off the CA server out of hours and test the interfaces to see if there are any impacts.
Gary.
I was talking to my coworker and we thought why I was spending time on this, if we can generate a self-signed certificate using IIS since that certificate will only be used internally between IIS servers.
Does that make sense?
Thanks.
It is an option but does mean that you will need to manually trust the certs on each of the servers and remember to manually renew them and repeat the same steps before they expire.
Gary.
Yes, I'm aware of that.
There will only be 3 servers and I can generate a certificate with 50 years.
I will generate a wildcard because I have many URLs.
I believe that is how I resolve this issue.