Unexpected DeltaCRL Location Seen

i installed root , issuing ca, specifying http locations crls. however, when @ issuing ca, see published deltacrl location #1 ldap. did not expect trying have http locations. below script used issuing ca post installation. normal or need specify else in config file below?

::issuing ca post installation script
 
::define crl publication intervals
certutil -setreg ca\crlperiodunits 2
certutil -setreg ca\crlperiod "days"
certutil -setreg ca\crloverlapunits 4
certutil -setreg ca\crloverlapperiod "hours"
certutil -setreg ca\crldeltaperiodunits 12
certutil -setreg ca\crldeltaperiod "hours"
 
::apply required cdp extension urls
certutil -setreg ca\crlpublicationurls "65:%windir%\system32\certsrv\certenroll\%%3%%8%%9.crl\n6:http://pki.domain.com/certenroll/%%3%%8%%9.crl"
 
::apply required aia extension urls
certutil -setreg ca\cacertpublicationurls "1:%windir%\system32\certsrv\certenroll\%%1_%%3%%4.crt\n2:http://pki.domain.com/certenroll/%%1_%%3%%4.crt\n32:http://ocsp.domain.com/ocsp"
 
::enable auditing events issuing ca
certutil -setreg ca\auditfilter 127
 
::set maximum validity period issued certificates
certutil -setreg ca\validityperiodunits 2
certutil -setreg ca\validityperiod "years"
 
::restart certificate services
net stop certsvc & net start certsvc

---

mcitp exchange 2010 | mcts exchange 2007 | mcitp lync server 2010 | mcts windows 2008 | mcse 2003

no there not. delta crls not written location http location.

the 6 indicates 2 indicates included in cdp of issued certificates , 4 indicates included in freshest crl extension of base crls.

to publish web server, need 1 of 2 methods:

1) scheduled task publishes new base crl/delta crl certenroll folder, waits, , uses copy protocol copy web server. copy protocol can used. have used ftp s/ftp rcp scp, copy, xcopy, , robocopy depending on environment. separate delta crl scheduled task required delta crl intervals

2) add file://\\webservername\sharename\%3%8%9.crl url , have value of 65 (so publishes base , delta crls location

this requires smb/cifs access used copy , ca computer account has read write access share , ntfs read/write/modify permissions

your choice

brian

Windows Server  >  Security