Enterprise CA generates multiple CRL's

Question

Hi!
I have PKI infrastructure:

1. Offline standalone root CA. Non Domain, windows server 2022
2. Online subordinate issuing enterprise CA. Domain, windows server 2022

And I see something weird: there are multiple CRLs in C:\Windows\system32\CertSrv\CertEnroll folder.
These names are (SubCA - is the name of subordinate CA):

1. SubCA(1).crl
2. SubCA(1)+.crl
3. SubCA(2).crl
4. SubCA((2)+.crl

At first I thought some of them were outdated CRLs. But after manual publish CRL I saw that all of this CRL were updated.
In Extensions tab at CA property I have next properties for CDP (I show only where the checkbox is checked):

At pkiview.msc console I see next:

So, my question is: Why I have two sets of CRL files?
It's not that it bothers me much. But I would like to understand: why is this happening there?

Answer 1

Hello Ebrenii,

Regarding the multiple CRL files you're seeing in C:\Windows\system32\CertSrv\CertEnroll, with names like:

SubCA(1).crl

SubCA(1)+.crl

SubCA(.crl

SubCA((2)+.crl

This behavior is typically caused by multiple CDP entries in your CA's Extensions tab that use different formatting tokens (like <CRLNameSuffix> and <CaName>), especially when publishing both base CRLs and delta CRLs to the same location. Each combination of these tokens can result in a uniquely named file—even if they point to the same logical CRL data.

Here’s what’s likely happening:

Each CDP entry with a checked “Publish CRLs to this location” or “Publish Delta CRLs to this location” generates a CRL file using its own naming pattern.

If multiple CDP entries resolve to the same folder path but use different name suffixes or formatting, you’ll see multiple CRL files—even though they’re all updated simultaneously when you publish.

This is expected behavior and not harmful, but it can be cleaned up by consolidating your CDP entries to use consistent naming and paths.

To reduce clutter:

Review your CDP entries in the Extensions tab and ensure only the necessary ones are checked.

Use consistent formatting tokens to avoid redundant file names.

You can also manually clean up unused CRL files if you're confident they’re not referenced in AIA/CDP locations or by clients.

Your pkiview.msc output showing all locations as “OK” confirms that your distribution points are functioning properly, so this is more of a cosmetic/configuration quirk than a functional issue.

=====

If this explanation helps clarify things, feel free to hit “Accept Answer” so others can benefit too 😊

T&B, Harry.