Push out CRL with group policy

All replies

• 

  

  0

  Sign in to vote

   can use certmgr.exe http://msdn.microsoft.com/en-us/library/e78byta0%28v=vs.80%29.aspx :

  /CRL	Adds or deletes CRLs. Displays CRLs when used without the /add, /delete, or /put options.

  Monday, February 27, 2012 4:42 PM
• 

  

  0

  Sign in to vote

  Hi,

  Thanks for your posting.

  I think maybe you misunderstand certificates and certificates revocation list (CRL).

  That certificate you get from VeriSign, of course it’s issued by VeriSign. That certificate is trusted automatically by all of your workstation, so it’s no need to deploy that certificate to your clients. Since MS system trust certificates issued by some well-known Certificate Authority (include VeriSign), all root certificates of these well-known CA are build-in in MS system.

  You can check it: run mmc-->File-->Add/Remove Snap-in-->Certificate-->Add-->Computer Account-->Local computer-->Trusted Root Certification Authorities-->Certificates

  Also it’s no need to push CRL for your clients. Double click your VeriSign certificate-->Details-->CRL Distribution Points-->URL

  You can find a website URL, workstation will contact that URL to renew CRL if needed.

  For more information please refer to following MS articles:

  CA Maintenance
  http://technet.microsoft.com/en-us/library/cc782041(v=WS.10).aspx
  Certificate revocation
  http://technet.microsoft.com/en-us/library/cc739845(v=ws.10).aspx
  Revoking certificates and publishing CRLs
  http://technet.microsoft.com/en-us/library/cc782162(v=WS.10).aspx

  Hope this helps, any confusion or further questions please let us know.

  ---

  Lawrence

  TechNet Community Support

  

  Tuesday, February 28, 2012 8:15 AM
• 

  

  0

  Sign in to vote

  Thanks Lawrence,

  I was able to install the certfication that was given to us by a vendor, via a group policy http://technet.microsoft.com/en-us/library/cc770315(v=ws.10).aspx 

  They also had two crl files that need to be installed I am guessing now, only if we install manually and the workstation has no internet access.

  Lets see if I understand this or not. Once the certificate is installed, the workstation will install the CRL if needed from the URL provided  in the Cert?

  thanks for your input on this subject.

  Mark.

  ---

  Mark

  Tuesday, February 28, 2012 4:58 PM
• 

  

  0

  Sign in to vote

  Hi,

  Thanks for your posting.

  Certificate Revocation List (CRL) can update form URLs defined in certificate CRL Distribution Point (CDP). These URLs can be either HTTP, FTP, LDAP or FILE addresses, but these are all defined and set by Certificate Authority.

  CRL has a validity period, in most of case this is a period of time form 12 hours to some months. You can check the “Next update” time form your .crl file. Double click your .crl file-->General-->Next update

  Why we need CRL?
  Revocation of a certificate invalidates a certificate as a trusted security credential prior to the natural expiration of its validity period. There are a number of reasons why a certificate, as a security credential, could become untrustworthy prior to its expiration. Examples include:

  Compromise, or suspected compromise, of the certificate subject's private key.
  Compromise, or suspected compromise, of a certification authority's private key.
  Discovery that a certificate was obtained fraudulently.
  Change in the status of the certificate subject as a trusted entity.
  Change in the name of the certificate subject.

  These reasons are all apply to a scenario you may don’t trust a certificate, but I think your workstations will always trust that purchased certificate until that certificate expires. And if one day you don’t need that certificate or you don’t trust that certificate, just remove or update it form your deployed application.

  So for your current scenario, it’s no need and you can’t update that CRL for your offline (no internet connection) workstations.

  For more information please refer to following MS articles:

  Certificate revocation
  http://technet.microsoft.com/en-us/library/cc739845(v=ws.10).aspx
  Specify certificate revocation list distribution points in issued certificates
  http://technet.microsoft.com/en-us/library/cc773036(v=ws.10).aspx
  Revoking certificates and publishing CRLs
  http://technet.microsoft.com/en-us/library/cc782162(v=WS.10).aspx

  ---

  Lawrence

  TechNet Community Support

  

  • Proposed as answer by IT Smurf Wednesday, February 29, 2012 1:43 PM
  • Marked as answer by Lawrence, Thursday, March 1, 2012 1:12 AM

  Wednesday, February 29, 2012 1:59 AM
• 

  

  0

  Sign in to vote

  Hello,

  Thank you for the detailed explanation and the URL's for further information. I believe I understand the concept now and your explantaion is greatly appreciated and has answered my inital question.

  Thank you,

  ---

  Mark

  Wednesday, February 29, 2012 1:18 PM