Home / server / Questions / 381809
Accepted
Dean
Asked: 2012-04-22 05:40:29 +0800 CST

Windows Server 2003: Taking Root and Intermediate CA's offline causers faiure in Enterprise CA

  • 772

I installed 3 CA's in lab environment:

  1. SA Root CA
  2. SA Intermediate CA
  3. Enterprise CA (also DC)

The instructor recommends taking Root and Intermediate CA's offline once the Enterprise CA has been issued it's certificate. I took Root and Intermediate CA's offline and now the Enterprise CA's certificate cannot be verified because both Root and Intermediate CA's are in the chain of trust and are unavailible.

To overcome that I thought to publish the CRL's to a shared folder on a server that is always availible, but CRL's are valid only for a week. That means I have to bring both Root and Intermediate CA's up every week to publish CRL's?

What is the commonly proposed solution to such scenario?

certificate-authority crl windows-server-2003-r2

1 Answers

  1. Best Answer

    You are aware you can publish the CRL to Active DIrectory and then with a longer duration?

    http://networkerslog.blogspot.com/2010/12/publish-offline-certificates-and-crls.html

    And then I would put the validity higher - obviously. Otherwise it is too much work to republish the CRL's.

    • 2