jeudi 26 février 2015

What is the minimum acceptable time for "Freshest CRL" to be updated?



I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL, the base revocation cert is updated weekly, and the Freshest CRL (the differential) isn't updated for hours.


I discovered the command certutil -crl delta which will immediately update the freshest CRL but not sure how often validating clients will pull this delta.


Further confusing things, there is a Next CRL Publish field that is present on the base CRL and the differential.


Question




  • Does the field Next CRL Publish on the delta CRL indicate when the client should get a fresher delta? Or does this equal the value of the base CRL?




  • What is the minimum setting (+ X minutes) that Next CRL Publish should be set?




  • Do clients validate the delta CRL? Are there notable exceptions that do or don't validate?




  • Since my distribution mechanism is HTTP, do any clients use HTTP verbs or ETAGs to detect if a file was updated? (saving load and bandwidth of the CRL?)




  • Is there a maximum size that the freshest CRL should be, prompting a re-issue of the base CRL? (e.g. a tradeoff between performance and efficiency )







Aucun commentaire:

Enregistrer un commentaire