Share via

Publishing CRL with HTTP or HTTPS, what's the best practice?

Manuel Galdamez 121 Reputation points
2021-06-21T16:27:01.147+00:00

Hi all,

I'm wondering if it's a best practice for PKI to configure an internal CRL using HTTPS protocol.

I tried to find Microsoft documentation about this but I found third-party websites saying the best way to configure it is using HTTP, also found a website saying is possible con publish CRL with HTTPS but we need to configure a public certificate.

Can someone help me with Microsoft documentation about these configurations?

Thanks in advance.

Manuel

Windows for business | Windows Server | User experience | Other

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Florian R 10 Reputation points
    2024-04-11T07:48:27.47+00:00

    Hi Manuel,

    I know this is old, but it still comes up as one top results on some searches about PKI, so I just wanted to leave a short answer.

    Best practice is http and not https. When checking documentation like the one Fan Fan linked above, you will also always find only http in the CDP links.

    I don't have a source in writing for as to why this is, but it's kind of a logical issue about how CRLs work. (and the same why OCSP also only uses http and the special OCSP signing certs have an extension that says "do not check revocation for this cert)

    A client wants to access a webserver that uses one of your CAs' certs for https. It then has to check the revocation. For that, it accesses the CRL - also a WebServer. Now, if it would use https for the CRL, it would get shown a TLS cert from the WebServer that hosts the CDP. Then, it would need to check the revocation of THIS cert. For that, it looks into the cert, gets the CDP URL, connects to check the CRL - and is again on https, sees a Webserver cert, has to check its CRL, and so on and so on ... So, unless you use a cert from a different CA (with a differen CDP) or a public cert for your CRP, you potentiall shoot your clients into a vicious circle of revocation checkings they can't escape from ...

    2 people found this answer helpful.
    0 comments
  2. Anonymous
    2021-06-21T23:45:21.5+00:00

    Hi,

    Welcome to share here!

    I tried to find more information about the question.

    Hope the following link would be helpful.
    How to Publish the CRL on a Separate Web Server
    https://social.technet.microsoft.com/wiki/contents/articles/485.how-to-publish-the-crl-on-a-separate-web-server.aspx

    Best Regards,

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.