aa) not that the client workstation would check the CRL. Actually, DCs check the client's certificate for validity against CRL. So if you deleted the caches on the client, it does not have effect. You need to purge caches on all the DCs.
a) CRL has some validity period. When a CRL client downloads the CRL, it caches it for the duration of the validity period and does not touch the CRL Distribution Point anymore
b) if a CRL client has already downloaded a valid CRL, it will not re-download it even after you re-publish a new CRL. This means, that re-publishing CRL works only for CRL clients that have not yet obtained the previous CRL
c) yes, you are right, you can delete the CRL cache. But how did you do it? Every user has a CRL cache. The system has CRL cache. Network Service has its own separate CRL cache. There is now way how to delete all the system caches at once. There are also
two caches - on disk and in memory caches. You would need to delete the disk caches for each user identity (user, system, network service, whatever...) by using:
certutil -urlcache * delete
and then restart the computer, or delete also the in memory cache by using the follwoing command for each user identity (your user, System, Network Service, whatever...):
certutil -setreg chain\ChainCacheResyncFiletime @now
d) this problem with deleting the caches means, that you are never sure, whether the cache has been really refreshed. rather wait for the CRL to expire normally to be sure to continue testing.
All in all, I would wait for the normal CRL expiration to be sure it is really recached, and maybe shortened the interval during the testing period.
ondrej.
Smartcard logon not supported for your user account
