I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL
, the base revocation cert is updated weekly, and the Freshest CRL (the differential) isn't updated for hours.
I discovered the command certutil -crl delta
which will immediately update the freshest CRL but not sure how often validating clients will pull this delta.
Further confusing things, there is a Next CRL Publish
field that is present on the base CRL and the differential.
Question
Does the field
Next CRL Publish
on the delta CRL indicate when the client should get a fresher delta? Or does this equal the value of the base CRL?What is the minimum setting (+ X minutes) that
Next CRL Publish
should be set?Do clients validate the delta CRL? Are there notable exceptions that do or don't validate?
Since my distribution mechanism is HTTP, do any clients use HTTP verbs or ETAGs to detect if a file was updated? (saving load and bandwidth of the CRL?)
Is there a maximum size that the freshest CRL should be, prompting a re-issue of the base CRL? (e.g. a tradeoff between performance and efficiency )
Aucun commentaire:
Enregistrer un commentaire