Offline Root Certificate Server and subordinate CA

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

As recomended, I keep my domains root CA offline.
My suborinate CA, works good in delivering the certs to the domain clients.

However, when ever I need to request a certificate to a web server or other,
the subordiante hangs and throughs an error on the certsrv web page.

If I put the root server back online, this does not occur.


What does the suborniate need, to be independant of the root server to allow
certificates to be requested? What is is looking for from the root server?
 
Possibly the links below will help. When you install a offline CA you need
to make sure that you change the location for the CRL/AIA so that it is
available and you also need to update the crl for the offline CA to keep it
current. Look in the Event Viewer of the subordinate CA for any pertinent
events that may be helpful.--- Steve

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/webenroll.mspx

http://www.microsoft.com/resources/...d/proddocs/en-us/sag_CS_Checklist_offline.asp
-- installing an offline CA.
 
Hi Steve,
It appears that I did not correctly set up my CRL and AIA publication
settings from the get go.
I deployed my enterprise offline root and subordinate CA with these defaults.
I am using AD and GP with autoenrollment for deploying ONLY the certificate
chain to the client computers .
I currently have a limited internal cert deployment, only for PEAP for
wireless.

I hope there is an easy fix...
I see where to change the CRL, AIA settings .....After I update them
Do I have to re-issue all the published certificates? And/or will the
changes (if allowed) propagate down the chain?

I also read, that it is recommended to configure empty CDP and AIA ext to
ensure that the certificate chaning engine does not perform revo checking on
the rootCA. Do you agree?

Before I set my CRL and AIA.....
I need to plan ahead for the day my subordinate server is replaced with
another, and want to have a consistent dns cname for the CRL and AIA files (
I don't want to use a server name) . I prefer to use the LDAP or a DNS
pointer to the current subordinate CA http.
 
As far as I know you will need to reissue those certificates that are used
by applications that need to find the CRL for the CA [apparently not all of
yours do]. The CRL/AIA is included on each issued certificate and is where
the application will look for the CRL or CA certificate if it needs it.
After you change it, newly issued certificates will contain the new info. As
far as the empty CDP/AIA, that depends on your particular needs for security
and performance. I have also read where it is recommended in many situations
to increase the length of CRL life to six months for the offline CA based on
the assumption that it is secured and the likelyhood that it would ever have
it's certificate revoked is extremely unlikely. --- Steve
 
microsoft.public.win2000.security news group, Steven L Umbach
As
far as the empty CDP/AIA, that depends on your particular needs for security
and performance.
Click to expand...

The requirement for empty AIA and CRL distribution points for a root CA
has nothing to do with performance nor security. For the AIA, the AIA
location is used to build a certificate chain and the AIA distribution
point in an issued certificate is used to locate the certificate of the
CA that issued that certificate. To find the root CA certificate, all we
need is the AIA location from any certificate issued by the root. The
root is the top level so once we have its certificate, we don't need to
find anymore, therefore no need for an AIA distribution point in it.
As far as having an empty CDP location for the root, RFC 3280 calls for
applications to stop revocation checking one level below a self signed
certificate in the chain. Also, keep in mind that a CRL is a signed
document, so with the root CA you've got a chicken and egg situation. If
you were to revoke the root CA certificate, you then need to use the
revoked certificate to sign the CRL that contains the revocation. :-)
I have also read where it is recommended in many situations
to increase the length of CRL life to six months for the offline CA based on
the assumption that it is secured and the likelyhood that it would ever have
it's certificate revoked is extremely unlikely.
Click to expand...

Now you're confusing the CRL that a root CA issues (which would only
ever contain certificates that it issued) with a theoretical CRL that
would contain its own certificate.

--
Paul Adare
"On two occasions, I have been asked [by members of Parliament],
'Pray, Mr. Babbage, if you put into the machine wrong figures,
will the right answers come out?' I am not able to rightly apprehend
the kind of confusion of ideas that could provoke such a question."
-- Charles Babbage (1791-1871)
 
Thanks for clearing that up Paul. Excellent explanation. --- Steve


Paul Adare said:
microsoft.public.win2000.security news group, Steven L Umbach
As
far as the empty CDP/AIA, that depends on your particular needs for
security
and performance.
Click to expand...

The requirement for empty AIA and CRL distribution points for a root CA
has nothing to do with performance nor security. For the AIA, the AIA
location is used to build a certificate chain and the AIA distribution
point in an issued certificate is used to locate the certificate of the
CA that issued that certificate. To find the root CA certificate, all we
need is the AIA location from any certificate issued by the root. The
root is the top level so once we have its certificate, we don't need to
find anymore, therefore no need for an AIA distribution point in it.
As far as having an empty CDP location for the root, RFC 3280 calls for
applications to stop revocation checking one level below a self signed
certificate in the chain. Also, keep in mind that a CRL is a signed
document, so with the root CA you've got a chicken and egg situation. If
you were to revoke the root CA certificate, you then need to use the
revoked certificate to sign the CRL that contains the revocation. :-)
I have also read where it is recommended in many situations
to increase the length of CRL life to six months for the offline CA based
on
the assumption that it is secured and the likelyhood that it would ever
have
it's certificate revoked is extremely unlikely.
Click to expand...

Now you're confusing the CRL that a root CA issues (which would only
ever contain certificates that it issued) with a theoretical CRL that
would contain its own certificate.

--
Paul Adare
"On two occasions, I have been asked [by members of Parliament],
'Pray, Mr. Babbage, if you put into the machine wrong figures,
will the right answers come out?' I am not able to rightly apprehend
the kind of confusion of ideas that could provoke such a question."
-- Charles Babbage (1791-1871)
Click to expand...
 
Back
Top