How to we clear CRL cache in Windows Server 008 using certutil command

active-directoryad-certificate-servicescrl

I know we can clear the CRL Cache in Windows Server 2008 using the certification authority UI. However, I want to automate the process and therefore looking a way to do it from command line. Is it possible using certutil or any other default utilities in windows?

Regards,

Andy

Best Answer

To get a client cache to refresh, the CRL would need to expire - there's no way to 'push' notification that a client needs to get a new CRL from the CA side. You can certainly set the CRL to expire very quickly, but that's a bit counter-intuitive, as the full CRL would need to be downloaded very frequently by every client.

A more appropriate solution (or rather, solutions that were essentially built for this specific case) would be to publish fast-expiring delta CRLs (so that clients can grab a very small file and still be up to date with recent revocations - potential delay times will range up to the delta CRL interval) or an OCSP responder (which will have revocation information instantly).

If it would be possible for you to implement one of those solutions, then that's what I'd suggest - otherwise, you may simply be stuck with a very-quickly-expiring main CRL.

Related Solutions

How to publish a CRL for an internal Windows certification authority

You will need to modify your CA's CRL locations via the Certification Authority snap-in. Right-click on the CA, select 'Properties', then the Extensions tab. Select the 'CRL Distribution Point' extension and add the needed locations.

Full instructions are located on Technet: http://technet.microsoft.com/en-us/library/ee649168(WS.10).aspx

Unfortunately, the CRL paths are 'wired' to the issued certs, so if you already have certs that have been previously issued, they will need to be reissued. Just create a new certificate template that supersedes the old one and configure your machines to autoenroll.

How large is the certificate OCSP and CRL cache in the Windows server

Monitoring the cache size is important when any PKI application needs to verify the CRL of several certificates. AD for example will consume 100MB of RAM for 50,000 OCSP users vs 4MB when using the CRL method of validating users' certificates. reference

There are two types of caches, disk and memory. Although this doesn't directly answer the question perhaps the size of the disk cache will help one infer the size of the memory cache

The CRL disk cache size is found by typing the command

 certutil -urlcache crl

...and multiplying by 80 bytes per entry

The OCSP disk cache size is found by typing

 certutil -urlcache ocsp

and multiply the entry count by 2 kilobytes (KBs).

Best Answer

Related Solutions

How to publish a CRL for an internal Windows certification authority

How large is the certificate OCSP and CRL cache in the Windows server

Related Topic