First published on TECHNET on Apr 13, 2007
The CA is automatically publishing its own certificates and related CRLs into Active Directory if a LDAP reference is configured in the CA property “Extensions”.
If you are using a different LDAP server (such as Microsoft ADAM ) to make the CA certificate and CRL available, certificates and CRLs must be published manually. The easiest way to do that is with certutil.
Perform the following command to publish the CRL manually into a LDAP-store.
certutil –addstore "LDAP://[server]/[DN]?certificateRevocationList?base?objectclass=cRLDistributionPoint" [CRL-File]
Replace [server] with the name of the LDAP server where you have write permissions.
Replace [DN] with the path that you have used in the CA configuration.
Replace [CRL-File] with the file name of the CRL that you want to publish.
Here is the command to publish a CA certificate manually:
certutil –addstore "LDAP://[server]/[DN]?cACertificate?base?objectClass=certificationAuthority" [cert-file]
To manually publish a CA certificate or CRL into Active Directory you should still use certutil –dspublish instead of certutil –addstore .
