Windows Server TechCenter >
Windows Server Forums
>
Security
>
Can I undo the change that allowed me to Ignore Offline CRL Errors on our CA?
Can I undo the change that allowed me to Ignore Offline CRL Errors on our CA?
- We recently had an issuing CA that did not have it's CRL renewed from the offline Root CA. So of course the CA services could not be started.
I disabled the offline CRL check using the following command "certutil –setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE"
So now that we have learned our lesson and are makking sure that we have a proper maintenace plan in place. One of my questions is if it is ok to leave this setting as is. And if not, how do I reverse the change?
Brad
Answers
- You're going to kick yourself <G>
certutil –setreg ca\CRLFlags -CRLF_REVCHECK_IGNORE_OFFLINE
net stop certsvc && net start certsvc
and then, throw away all knowledge of this "poor PKI person" command <G>
Brian- Marked As Answer byBrad Hearn Friday, November 06, 2009 2:22 PM
All Replies
- You're going to kick yourself <G>
certutil –setreg ca\CRLFlags -CRLF_REVCHECK_IGNORE_OFFLINE
net stop certsvc && net start certsvc
and then, throw away all knowledge of this "poor PKI person" command <G>
Brian- Marked As Answer byBrad Hearn Friday, November 06, 2009 2:22 PM
- Consider me kicked :) Thanks Brian.
