Basics: Delta CRLs

Certificate revocation lists (CRLs) are used to remove issued certificates from circulation before the end of their validity period.

A CRL is a signed list of the serial numbers of certificates that have been revoked by the certification authority. The CRL has an expiration date (usually only a few days ahead) and is reissued and signed by the associated certification authority at regular intervals.

Certificate revocation lists can reach a considerable size if the volume of revoked certificates is high (as a rule of thumb, you can expect about 5 megabytes per 100,000 entries). The regular download of large certificate revocation lists by subscribers can generate a large network load. To address this problem, there is the concept of delta CRLs.

How it works

The idea with delta CRLs is to extend the publication intervals of the (supposedly large) base CRL so that it needs to be downloaded less frequently by participants. Changes that have occurred since the last publication of the base CRL are written to the delta CRL, which is published at shorter intervals.

A base CRL can therefore have several delta CRLs associated with it. When publishing certificate revocation lists, you have the choice of publishing the base CRL or a new delta CRL.

If delta CRLs are active, the base CRL has an extension called "Freshest CRL" which contains the URL for downloading the delta CRL.

If delta CRLs are activated, a revocation status check is thus only possible if both the base CRL and an associated delta CRL can be retrieved and are time valid.

Mapping in Microsoft Active Directory Certificate Services

Configuration

The configuration of the CRL validity is mapped in the registry under the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\{Name-der-Zertifizierungsstelle>

Default values

If you install a Microsoft Certification Authority with default settings, delta CRLs are automatically enabled with the following settings:

As you can see, the values for the overlap periods are set to 0 in each case. However, this does not mean that the CRL overlap is thus enabled. Rather, the certification authority applies default values of 12 hours. This results in the following validity periods in the default setting:

• The base CRL is valid for 180 hours (1 week + 12 hours) and is renewed 12 hours before expiration.
• The delta CRL is valid for 36 hours (1 day + 12 hours) and is renewed 12 hours before expiration.

On the usefulness of delta CRLs

Most enterprises will never find themselves having to revoke so many certificates that significant load situations could occur without delta CRLs. De facto, most companies have not even implemented a resilient certificate revocation process.

The use of delta CRLs can provide a security advantage (due to their usually very short validity periods), as certificate revocations become effective very quickly.

It should be noted, however, that the time required for emergency measures such as the establishment of an emergency CRL in the event of a certification authority or hardware security module failure is equally drastically shortened by the use of delta CRLs.

Thus, the decision for or against delta CRLs ultimately depends on the use cases employed. However, it can be said that the requirement for operability (operational stability) will generally take precedence over any certificate revocations that become effective at short notice.

An alternative to delta CRLs can be the use of an Online Responder (OCSP) . However, this service is only suitable for improving efficiency.

Disable delta CRLs

In many cases, it may make sense to deactivate the delta CRLs and instead prefer to work with larger overlap periods of the base CRL.

Deactivate via the registry

If you set the "CRLDeltaPeriodUnits" in the registry to the value 0 and then restart the certification authority, it will no longer issue delta CRLs.

certutil -setreg CA\CRLDeltaPeriodUnits 0
net stop certsvc
net start certsvc

It is advisable to issue a new base CRL directly, which no longer refers to a delta CRL, i.e. no longer has a "Freshest CRL" extension.

certutil -crl

However, deactivating the delta CRLs via the registry has the disadvantage that there may be problems with certificate revocation lists cached at the subscribers. They may continue to use the old base CRL until it expires, but they can no longer access an associated valid delta CRL because these are no longer issued.

Therefore, it is advisable to always disable delta CRLs via the Certification Authority Management Console.

Disable via the Certification Authority Management Console

In the Certification Authority Management Console, delta CRLs can be configured by right-clicking on the revoked certificates folder.

If the "Publish Delta CRLs" checkbox is removed, the certification authority will no longer issue new delta CRLs.

However, something additional is happening behind the scenes. The certification authority immediately issues a new base CRL (pictured on the left), which no longer includes a "Freshest CRL" extension. In addition, however, a delta CRL (pictured right) is issued one last time, which has the same expiration date as the base CRL.

This prevents subscribers from encountering the inconsistent situation described earlier and from being unable to check certificates for their revocation status.

Related links:

• Basics: Checking the revocation status of certificates
• Basics: Online Responder (Online Certificate Status Protocol, OCSP)

External sources

• Configure CRL and delta CRL overlap period (Microsoft Corporation)
• Can disabling Delta CRL on a CA cause problems? (Tom Aafloen)