Purge expired certificates listed in CRLs?

to keep crl growing forever , becoming huge , slow use on time, have way of purging certificates expired , no longer need specified in crl?

i think if give our user , domain computers certificates , users come , go , workstations reimaged on , over, crl going large.  the same workstation reimaged multiple times in year , old certificates added crl. pc similar cert next time it's joined domain same computer name.

we can set user , workstation certificates expire in year or less, wouldn't make sense have process remove expired certificates crl file manage size , make faster to read?

the default behavior certificate's serial number removed crl 1 publication after expiration. if crl not having expired certificates removed, changed default behavior

you can run following command return ca default behavior:

certutil -setreg ca\crlflags -crlf_publish_expired_cert_crls

net stop certsvc && net start certsvc

from point on, certificate's serial number removed 1 crl publication *after* certificate's original validity period expires

hth

brian

Windows Server  >  Security