How to Publish New Certificate Revocation List (CRL) from Offline Root CA to Active Directory and Inetpub

Posted by Ahmed Nabil In | 7 comments»
Its highly recommended when building your Microsoft PKI (Public Key Infrastructure) to have your Root CA offline after issuing the Enterprise Sub CA certificates. Its recommended to minimize the access to the Offline Root CA as possible. The Root CA is not a domain joined machine and can be turned off without any problem.

One of the Key issue is the CRL generated from the Root CA, you need to set the CRL interval for a large value so that we don’t need to copy the CRL to an online location frequently and do not implement delta CRLs, because the publication of each delta CRL would require access to the offline root CA in order to copy the delta CRL to an online publication location. In order to change the CRL interval you need to:

  1. Turn on the Offline Root CA and login with Admin account
  2. Open the Certification Authority Console
  3. Right Click on the "Revoked Certificates" and click Properties.
  4. Set “CRL Publish interval” to a large value (Default is 26 Weeks) and  uncheck “Publish Delta CRL” check-box.

In order to Publish a new CRL from the offline Root CA to the Enterprise Sub CA you need to do the following:

  1. Publish a new CRL on the Root CA, this can be done by Right Click the "Revoked Certificates" - All Tasks - Publish                                                                                                                                                                                                                                                          
  2. Copy the CRL file from the Root CA located under %systemroot%\system32\certsrv\certenroll to the Sub CA Server
  3. Turn off the Root CA
  4. Copy the above file to the InetPub folder (HTTP Path) in the Sub CA server which is by default located under the C:\inetpub\wwwroot\Certdata
  5. Open an Admin Command Prompt and run the following command to publish it to the Active Directory (LDAP Path).                                                                                           certutil -f -dspublish " C:\Inetpub\wwwroot\certdata\RootCA.crl

This process of renewing the CRL and publishing a new one is manually done since the Root CA is offline and thats why its better to make the CRL publish interval more than the default value so you won't do it frequently. You may also want to set an automated reminder before the next renewal date.



Gus Gallows Says:

Excellent article. Thank you. This saved my bacon. Was wondering why my manual user cert requests were failing. Republished and moved the crl to the intermediary server and everything is working again. Thanks again.

Darrendu Du Says:

Excellent post !... Been searching for weeks on Microsoft website , no luck .Thank you

Moayad Hamdan Says:

very good article

Unknown Says:

Sweet Baby Jesus! After digging for 2 days straight trying to fix the dreaded "CRL Revocation" I find this... Thanks much!

Master Says:

Thanks a Lot, Excellent article, very useful and straight forward

TA News Says:


petrosgb Says:

Hi all,
i get the below error:

ldap: 0xa: 0000202B: RefErr: DSID-0310082F, data 0, 1 access points
ref 1: 'unavailableconfigdn'

CertUtil: -dsPublish command FAILED: 0x8007202b (WIN32: 8235 ERROR_DS_REFERRAL)
CertUtil: A referral was returned from the server.

Any ideas?

Post a Comment