Revocation in an Active Directory environment

Every certificate can carry two pointers. The CRL Distribution Point (CDP) says where to find the list of revoked serial numbers. The Authority Information Access (AIA) extension says where to find the issuer's own certificate.

1. 1

   Publish on a schedule shorter than the CRL validity

   If a CRL is valid for a week, publish daily so a late or failed publication never leaves clients without current data.

2. 2

   Keep the previous CRL available

   Overlap prevents a gap while caches and servers refresh.

3. 3

   Publish delta CRLs

   Deltas carry changes between full publications, so revocation takes effect faster.

4. 4

   Verify reachability

   Fetch each CDP URL from a client network, not from the CA itself.

5. 5

   Monitor age

   Alert when the published CRL is older than its expected cadence.

A CRL that is too large is also a problem: some clients time out or refuse to download it. Keep validity periods modest and consider delta CRLs for large estates.

The Online Responder role answers per-certificate status queries over OCSP. It is fresher than a CRL but introduces a service that must stay available — an outage can become a validation outage if clients hard-fail.

• Stapling moves the OCSP response to the server, removing client-side privacy leaks
• Revocation configuration arrays define which CA and which responder answers for which certificate
• High availability matters: two responders behind a load balancer is common
• Check whether clients soft-fail; many do, which silently weakens your policy

Revoking a certificate only affects clients that check revocation and can reach the data. For a serious incident — a leaked CA key, a misused template — you need more than a CRL entry.

• Revoke the certificate and publish a CRL immediately, without waiting for the schedule
• For an issuer compromise, distrust the intermediate or root in every client you control
• Hunt for certificates issued under the affected template or key, including unexpired ones
• Record the incident timeline, because auditors will ask what you knew and when