CRL CDP can use HTTPS port?

Question

CRL CDP can use HTTPS port?

Gan Seng Leng 1

hi,

can i ask if CRL CDP can use HTTPS port instead of port 80?

Thanks

poliveirasilva-MSFT 86 Microsoft Employee

   When certificates include a cRLDistributionPoints extension with an
   https URI or similar scheme, circular dependencies can be introduced.
   The relying party is forced to perform an additional path validation
   in order to obtain the CRL required to complete the initial path
   validation!  Circular conditions can also be created with an https
   URI (or similar scheme) in the authorityInfoAccess or
   subjectInfoAccess extensions.  At worst, this situation can create
   unresolvable dependencies.

   CAs SHOULD NOT include URIs that specify https, ldaps, or similar
   schemes in extensions.  CAs that include an https URI in one of these
   extensions MUST ensure that the server's certificate can be validated
   without using the information that is pointed to by the URI.  Relying
   parties that choose to validate the server's certificate when
   obtaining information pointed to by an https URI in the
   cRLDistributionPoints, authorityInfoAccess, or subjectInfoAccess
   extensions MUST be prepared for the possibility that this will result
   in unbounded recursion.

poliveirasilva-MSFT 86 Reputation points Microsoft Employee

2023-10-04T21:47:34.1166667+00:00

From: https://www.rfc-editor.org/rfc/rfc5280#section-8