Internal roo CA and CRL

Copper Contributor

I am trying to determine what would happen if the internal root CA power down for a day or unavailable for a few days. We have a root CA with no subordinate. I thought PCs and Servers would check the local cache file and determine whether a certificate was revoked or not. I came across a few articles that say to set the revocation list longer to avoid the CRL server offline issue; this way, you do not have to worry about the CRL.

I checked my PC's cache file with certutil -urlcache and noticed the Last sync time:1/28/2022. so a PC or server is synching the revocation list from time to time to ensure it has an up-to-date cache file whether we set a more extended period for revocation list or not.


CRL Distribution Point (CDP) as listed below.

ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=My-Server,CN=CDP,CN=Public Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>

What would happen if the CRL/CA server is not available with default installation above, that is, CRL is not in available central server? 



0 Replies