root CA's CDP location is unavailable

Question

Our client is using Microsoft Certificate Authority to issue a certificate to desktop computers to authenticate via 802.1X port authentication; both Network Policy Server and PCs are getting a certificate from this CA, which has a simple default installation. The CDP URL and AIA are with the default setting, and we have not moved it to another IIS.

We have to take this server offline(re-locate and change IP) for a few days. As I know, the computers download the CRL list and check the revocation certificate with it. A computer/server may look for new CDP list downloads.
Will this CDP's location be available from an AD container even though we power down the CA because the CDP location on the issued certificate points to LDAP: //LDAP, CN=issue, CN=etc ?

Will an application running on a PC/server relying on a certificate fails if the CDP location is unavailable? in our case, desktop pc are using a certificate for authentication and have a valid certificate for a year.

Answer 1

There are two parts to this question.

Will the LDAP CRL be used if the HTTP CRL location is not available, the simpe answer is yes, the revocation process will try the list of URL in the CRL extention in order. This makes the assumption that the CRLs has been published in all the specifed locations.

The second part will the client still work if the HTTP CRL location is off line, this is a little more complicated as there are a number of consideration. Is the client configured to perform a certificate revocation test, has the CRL been cached on the client, is the LADP CRL location available before 802.1x tunnel has been established.

Another option is to extended the CRL validation time so the local cache will be used if the CRL location is offline. see this page for more details.

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753863(v=ws.11)?redirectedfrom=MSDN

As always I would test the impact before switching off the server, probably the easiest way to do this to update the hosts configuration file to provide a invalid IP address for the server hosting the HTTP CRL.

Gary.