Step 3 - CRL Settings
If the CRL method was selected for the certificate status checking process for a CA, then the next step is to define the CRL repository address(es) for this CA and associated CRL processing policy, using the screen below:
The Add button is used to enter the URL for an online CRL repository. Multiple locations can be defined and connection to each location will be attempted in the order shown until a CRL is successfully retrieved. The Test button can be used to check that the URLs have been entered correctly.
When communication with a CRL resource is required over an TLS channel, it is required to register the issuer of the relevant TLS Server Authentication certificate in the Trust Manager with purpose CA (will be used to verify other certificates and CRLs). Restarting the ADSS Server windows service is required in this case so that the certificate can be stored in the JVM key store for TLS Server Authentication to succeed.
It is recommended that CRL settings are configured for the CA even if it has an OCSP Responder for two reasons:
-
The CRLs can act as a fall-back option in case an OCSP Responder becomes unavailable
-
ADSS Server can use the CRLs to provide historical certificate validation functionality. Even if not used today it is quite possible that such an option will be beneficial in the future. Once ADSS Server is set to record all the issued CRLs it is capable of determining the status of a certificate at any specified time and date from this point onwards.
The Configure CRL Settings screen defines the policy for how often the ADSS CRL Monitor retrieves the CRLs for this CA and how the overall process is to be managed:
Each field in the form is discussed in the table below:
| Item | Description |
| CRL Resource Settings | Defines the following: |
| Select a certificate issued by this CA to read CRL resource addresses from CDP extension |
Browse to a certificate issued by the CA you are registering and the system will get the CRL resources (HTTP/LDAP address) automatically from the CDP extension for automatic CRL polling. All the CRL resources will be added automatically in the CRL resources list box e.g.
|
| Manually add a CRL Resource |
If you want to add a CRL resource (HTTP/LDAP address) manually then enter the address of CRL resource and click the Add button to add the CRL resource into the CRL resources list box e.g.
|
| List of CRL Resources |
This contains the list of CRL resources that will be used to download the CRL. |
| CRL Download Policy | Defines the following: |
| Find the first acceptable CRL from any of the defined resources |
If this radio button is selected then the CRL will be downloaded from the first working resource/address from the list of configured resources/addresses. |
| Check CRLs from all the defined resources |
If this radio button is selected then CRL Monitor will monitor all the configured address and download the CRLs from all the resources. The latest CRL will be inserted in the database. Also, if some of the resoure(s) are not working then failure information will be logged in the CRL Monitor Logs about the failure |
| Find a segmented CRL from all the defined resources |
This radio button should be selected when the CA concerned issues reason based segmented CRLs and multiple addresses are configured to download all segments of a distributed CRL. Segmented CRLs are sometimes used as a dissemination mechanism for CRLs as they can restrict the size of the CRLs that need to be downloaded, allowing the CRL provider to service requests at a faster rate. Segmentation can also solve the practical problem of CRLs growing to unmanageable lengths by allowing CRLs to be segmented, based on size considerations or priority considerations related to revocation reasons. |
| Find a partitioned CRL from the defined base LDAP address |
This radio button should be selected when the CA concerned issues serial number based partitioned CRLs and an LDAP repository is configured to download all partitions of a distributed CRL. Partitioned CRLs are sometimes used as a dissemination mechanism for CRLs as they can restrict the size of the CRLs that need to be downloaded, allowing the CRL provider to service requests at a faster rate. Partitioning can also solve the practical problem of CRLs growing to unmanageable lengths by allowing CRLs to be partitioned, based on size considerations or a range of certificate serial numbers issued by the CA. Defines the following:
|
| CRL Polling Scheduler Settings |
Defines the following: |
| Enable automated polling | This checkbox defines whether or not ADSS CRL Monitor should perform CRL polling to retrieve CRLs for this CA. Any of the CRL polling configurations for a CA are only effective if this option is turned on. Otherwise CRL polling is not performed. |
| Next Fetch | This defines the date and time when the next attempt will be made to retrieve the CRL for this CA. Normally ADSS Server automatically sets this field, however for the first poll time the ADSS operator may define this. Note: For each CA, the CRL Next Fetch time is set as: time when CRL polling last completed (whether failed/successful) + Polling Period. Here the Polling Period can be Polling Period or Failure Polling Period depending on whether the attempt was successful or not. Any change in CRL Next Fetch done manually in Trust Manager by the ADSS operator (or any other change in the CRL Polling Settings section) will only be effective once the CRL Monitor is restarted. |
| Start Polling at Configurable Time |
This radio button setting defines if the CRL Monitor should poll for CRLs at a configurable time period (e.g. every 10 mins) regardless of the official nextUpdate field of the CRL. This is useful only if there is a possibility that the CA may issue emergency CRLs or over-issued CRLs in advance of the nextUpdate time defined inside the current CRL. Note: Even if the polling setting is based on a Polling Period at a Configurable Time, CRL Monitor always attempts to download the CRL whenever the previous CRL expires (i.e. when CRL nextUpdate time arrives), without waiting for the defined polling period time to elapse in case this is in the future. This ensures that ADSS Server retrieves all CRLs in a timely and effective way as soon as they are released.
|
| Start Polling at CRL next update |
As an alternative, this setting configures the CRL Monitor to poll for a new CRL only when the previous CRL NextUpdate time is reached. This saves resources since otherwise ADSS will fetch the same CRL at the end of every polling period interval. Note: CRLs are only updated when the CRL Next Update arrives unless of course emergency CRLs or over-issued CRLs are used. So check what your CA CRL publishing policy is and then set this accordingly. |
| Enable CRL Freshness Checking |
When enabled, ADSS Server will generate an email and/or SMS alert to the configured users whenever a new CRL is not published within the configured number of minutes from the previous CRL thisUpdate field. Note: This feature is useful when a CA is supposed to issue a CRL periodically (every few hours say) even though the previous CRL is still valid for a certain period longer. When configured,CRL freshness policy time can also be set as Next Fetch if it is lower than the other two criterias ( Start Polling at Configurable Time and Start Polling at CRL next update ). If the CA somehow fails to publish the CRL within the specified period from the previous CRL issuance, an alert will be sent but ADSS Server will still use the previous CRL as long as it valid or a newly published CRL is fetched. This setting is only useful if the CA is issuing so called over-issued CRLs. CRL Monitor alerts can be configured within the CRL Monitor. |
| Retry if Connection Fails |
Defines how long ADSS Server should wait before trying to fetch a CRL again following a failure to retrieve a CRL, e.g. ADSS Server may be unable to connect to the CRL resource (LDAP, HTTP) or perhaps the CRL may be corrupt or the signature on the CRL may be invalid |
| CRL Timeout |
Defines a CRL download timeout value for this CA. Note: It is recommended to configure a non-zero and realistic value for CRL timeout so that if the CRL downloading thread fails to download the CRL within the configured value for timeout, it will report a download failure and will again invoke the CRL download after allowing the time period after failure. In case the timeout is configured as “0” (unlimited) and downloading hangs for some reason then the CRL downloading thread will remain in a hung state until the Windows or Unix Service is restarted. Also note that a realistic value for timeout is a relative term. For instance, if download of a CRL is expected to complete within 1 minute then you must configure the value for timeout to be 2 or above. Also the value for timeout should be a little higher than the expected time for downloading so that the downloading thread gets some additional time in case the network is slow. In particular, the download time for the CRL will depend on the CRL size and network speed. |
| Advanced CRL Handling | Defines the following: |
| CA will issue its own CRL | This radio button is used if the CRL will be issued by the CA directly. It also defines the following:
|
| CA will use indirect CRLs |
This radio button is used if another CRL issuer will be used. When a CA uses indirect CRLs, then the CRL issuer must be selected from the drop-down list. Note: These CRL issuer details are defined separately within the Trust Manager module. |
| Use CRL in pending-update state |
If checked then when the new CRL is being downloaded, the previous valid CRL will be used by ADSS Server even though it is marked as PENDING. If unchecked then the previous CRL that is marked as PENDING will not be used. Revocation status for the target certificate will be returned as UNKNOWN in this case |
| CA issues delta CRLs |
Enable this checkbox if the CA issues delta CRLs. |
| Check CRL issuer revocation status |
Enable this checkbox if it is required to check the revocation status of the CRL Issuer certificate every time a new CRL arrives. If the CRL Issuer certificate revocation is not good (checked using the validation policy of the CA of the CRL Issuer) then the newly downloaded CRL will not be accepted. |
| Load CRL in memory for high speed revocation checking |
Enable this checkbox if it is required to generate high speed OCSP responses when the ADSS OCSP Service responds on behalf of this CA. |
| Retain old CRLs in database |
This is checked by default and it is used to keep the old CRLs in database when a new CRL arrives.When unchecked only the latest CRL is kept in the database. System removes the old CRLs from the database on arrival of a new CRL. |
| Publish CRL on File System |
Enable this option to store the newly downloaded CRL to a selected network location with the identified folder name. It defines following:
Note: This feature is useful in situations where end-users cannot access an external CRL directory directly (due to network restrictions) and ADSS Server is used to re-publish the CRLs on the local system or network. Alternatively this may be used as a High Availability measure to provide an alternative location for CRLs. |
| CRL Archive Settings | Defines the following: |
| Archived file path |
This is the path to the location where archived CRLs will be stored in CSV format (zipped). |
| Delete records from database once archived | Enable this option if you want to delete the CRLs from the database upon archiving. Note: Unless selected the CRLs will still remain present in the database even upon archiving. In such cases an archive back-up of the CRLs is created but database size is not reduced. It is therefore important to select this checkbox very carefully depending on the required objective for the archiving process. |
| Enable auto-archiving of CRLs | Check this option to enable the auto-archiving of CRLs. |
| Auto-archive every |
This value specifies how often (in days) the CRLs are archived. |
| Archive records older than |
The CRLs older than the configured number of days are auto-archived. |
| Archive at |
This value specifies the time on the day when auto-archiving will be performed. |
It is important to note that archiving is a highly intensive operation and it may impact the performance of the system. Hence it is important to schedule archiving at off-peak hours when end-users are not utilizing the services heavily. Alternatively a dedicated load balanced ADSS Server instance should be set-up for such housekeeping tasks by deploying ADSS Server Core and Service instances on different machines.
ADSS CRL Monitor will poll for new CRLs once per hour when the value for polling period is set to 0 minutes on the Configure CRL Settings screen. When CRL polling settings for a Certification Authority (CA) are changed so that the CRLs are downloaded on the NextUpdate time then this change will take effect when a new CRL is downloaded.
See also