locked
Publish CDP and AIA to LDAP RRS feed

 > 

  • General discussion

  • Discussion
    Sign in to vote
    0
    Sign in to vote

    Hello all,

    I'm planning a new (2 tier) PKI with Windows 2012 R2. Older literature recommends publishing CA Certificates and Certificate Revocation Lists to LDAP and Webservers, which is not recommended today. Most up-to-date recommendations say "Publish HTTP only". I agree on this point, and I'll add only HTTP paths to my certificates for CDP & AIA extensions. However, what would be the downside of publishing the CRT and CRL files to my Active Directory using certutil -dspublish, too?

    Andrzej says in his blog post "As HTTP is recommended path to publish CRT and CRL there is no need to use CDP and AIA with LDAP and to publish them to AD." And yes, there might be no NEED for this. But Brian says in his book Windows Server 2008 PKI and Certificate Security "The processing of Group Policy triggers the autoenrollment mechanism, initiating the automatic download for any certificates or CRLs published in AD DS to the forest members."

    I understand that as: Domain-joined Windows clients do not have to contact the Web Server in CDP/AIA of a certificate, because both, CRL and CRT, are already obtained from the client, if the files are published to Active Directory.

    So wouldn't in it be the best practice to publish only http paths to:

    1. Publish http paths only for CDP and AIA information in issued certificates for highest compatibility and least information leak
    2. But still publish the actual CRLs and CRTs to Active Directory to increase availability and decrease traffic over WAN (because AD is already decentralized) for domain members

    What's your opinion on this? And does anyone have more detailed information of how exactly a Windows client does certificate chaining and revocation checking?

    Michael

    Thursday, June 23, 2016 3:27 PM

All replies

  • Discussion
    Sign in to vote
    0
    Sign in to vote

    Don't do it.

    NEVER USE LDAP FOR CDP AND AIA Extensions.

    Am I clear.

    Brian

    Thursday, June 23, 2016 3:29 PM
  • Discussion
    Sign in to vote
    0
    Sign in to vote
    I would suggest to read this blog post which describes best practices: https://www.sysadmins.lv/blog-en/designing-crl-distribution-points-and-authority-information-access-locations.aspx

    Vadims Podāns, aka PowerShell CryptoGuy
    My weblog: www.sysadmins.lv
    PowerShell PKI Module: PSPKI
    Check out new: SSL Certificate Verifier
    Check out new: PowerShell File Checksum Integrity Verifier tool.

    Friday, June 24, 2016 7:29 AM
  • Discussion
    Sign in to vote
    0
    Sign in to vote

    Hi Brian,

    you are clear, but you are not answering the question: What is the downside of having the CRL and CDP files stored in Active Directory? And will Windows Clients retrieve CRLs and CRTs from Active Directory, without having those paths in the Certificates AIA and CDP extension?

    Thanks,
    Michael

    Friday, June 24, 2016 9:25 AM
  • Discussion
    Sign in to vote
    0
    Sign in to vote

    Hi Vadims,

    I have already read your blog post, the part of configuring the share was helpful, but article essentially concentrates on the CDP and AIA extension, which I'll definitely configure for http only. But my question is more like: Is there any advantage or disadvantage of storing the CRTs and CRLs in Active Directory, too?

    In your Certificate Chaining Engine (CCE) wiki post you write: 

    "Windows operating system uses the following methods for retrieving certificates for certificate chains:

    1. Via the local certificate store
    2. Using the Authority Information Access (AIA) extension
    3. Using a PKCS#7 container with a full or a partial chain,
    4. Crypt32.dll and Microsoft Update web site"

    Does that mean, if it is in the local certificate store, AIA is not checked? Or will be always all four methods used and the last wins?

    Thanks,
    Michael

    Friday, June 24, 2016 9:39 AM
  • Discussion
    Sign in to vote
    1
    Sign in to vote

    There are no advantages in storing CRLs in Active Directory. If there is no direct link to these CRLs, no one will fetch them.

    > Does that mean, if it is in the local certificate store, AIA is not checked?

    correct. CCE will use URLs in the AIA extension only when all other methods failed.

    Vadims Podāns, aka PowerShell CryptoGuy
    My weblog: www.sysadmins.lv
    PowerShell PKI Module: PSPKI
    Check out new: SSL Certificate Verifier
    Check out new: PowerShell File Checksum Integrity Verifier tool.

    Saturday, June 25, 2016 2:42 PM
  • Discussion
    Sign in to vote
    0
    Sign in to vote
    So, there is no advantage of storing CRLs in Active Directory, but there is an advantage of storing CRTs in Active Directory, because they will be fetched from Domain Members. Can I say it like this?
    Monday, June 27, 2016 7:02 AM
  • Discussion
    Sign in to vote
    1
    Sign in to vote
    So, there is no advantage of storing CRLs in Active Directory, but there is an advantage of storing CRTs in Active Directory, because they will be fetched from Domain Members. Can I say it like this?

    yes

    Vadims Podāns, aka PowerShell CryptoGuy
    My weblog: www.sysadmins.lv
    PowerShell PKI Module: PSPKI
    Check out new: SSL Certificate Verifier
    Check out new: PowerShell File Checksum Integrity Verifier tool.

    Tuesday, June 28, 2016 2:58 PM
  • Discussion
    Sign in to vote
    0
    Sign in to vote
    Thank you Vadims!
    Friday, July 1, 2016 7:15 AM