ADCS HTTP CDP - Revision history

Ledhed at 04:00, 25 September 2025

2025-09-25T04:00:25Z

Ledhed at 03:57, 25 September 2025

2025-09-25T03:57:42Z

Ledhed: Created page with "== Overview == CRL Distribution Point (CDP) must be published in a certificate to that the client can verify whether a certificate has been revoked. By default Active Director..."

2025-09-25T03:57:17Z

Created page with "== Overview == CRL Distribution Point (CDP) must be published in a certificate to that the client can verify whether a certificate has been revoked. By default Active Director..."

New page

== Overview ==
CRL Distribution Point (CDP) must be published in a certificate to that the client can verify whether a certificate has been revoked. By default Active Directory Certificate Services (ADCS) publishes these in LDAP and adds them to the CDP/AIA settings of the certificate template. This is less than ideal because not all devices on the network have access to query LDAP (at least they shouldn't if you have your LDAP to require authentication). The solution to this is to publish CDP/AIA information on a web/http server that all devices on the network can access.

== Quick -n- Dirty ==
* Create DNS entries (pki.yourdomain.tld or crl.yourdomain.tld, etc...)
* Install IIS (not on the server hosting ADCS)
* Create a directory named (CRL, CDP, PKI, etc...)
* Share that directory (hide it with a trailing $, PKI$), granting the 'CertPublishers' AD group read/write access (this should grant the ADCS Root CA access to publish the CRL file)
* Create virtual directory pointing to the directory you just created (PKI)
* Add the following entries to the Certificate Template's CDP settings under the Extensions tab
file:\\pki.yourdomain.tld\CDP$\<CaName><CRLNameSuffix>.crl
http://pki.yourdomain.tld/<CaName><CRLNameSuffix>.crl
* The file:// entry will cause the CA to publish the CRL to this path any time a new CRL is generated
* The http:// entry will tell the client where to find the CRL via the http protocol
* Add the following entry to the Certificate Template's AIA settings under the Extensions tab
http://pki.yourdomain.tld/<CaName><CRLNameSuffix>.crl

== Reference ==
https://security.stackexchange.com/questions/206243/how-to-automate-publication-of-crl-and-crt-files-to-cdp-and-aia-location
https://www.youtube.com/watch?v=U9gDL4GsJxs

[[Category:Windows]]
[[Category:Active Directory]]
[[Category:PKI]]

@@ Line 11: / Line 11: @@
 * Create virtual directory pointing to the directory you just created (PKI)
 * Add the following entries to the Certificate Template's CDP settings under the Extensions tab
   file:\\pki.yourdomain.tld\CDP$\<CaName><CRLNameSuffix>.crl
   http://pki.yourdomain.tld/<CaName><CRLNameSuffix>.crl
 * The file:// entry will cause the CA to publish the CRL to this path any time a new CRL is generated
 * The http:// entry will tell the client where to find the CRL via the http protocol
 * Add the following entry to the Certificate Template's AIA settings under the Extensions tab
   http://pki.yourdomain.tld/<CaName><CRLNameSuffix>.crl

@@ Line 21: / Line 21: @@
 == Reference ==
-https://security.stackexchange.com/questions/206243/how-to-automate-publication-of-crl-and-crt-files-to-cdp-and-aia-location
+https://security.stackexchange.com/questions/206243/how-to-automate-publication-of-crl-and-crt-files-to-cdp-and-aia-location <br>
 https://www.youtube.com/watch?v=U9gDL4GsJxs