I often hear that PKI operators would like to see a new certificate revocation list issued immediately for revoked certificates.
Below, I would like to share some thoughts on why this approach is not ideal and propose a more elegant solution.
Certificate revocation lists (CRLs) are used to remove issued certificates from circulation before the end of their validity period.
A CRL is a signed list of the serial numbers of certificates that have been revoked by the certification authority. The CRL has an expiration date (usually only a few days ahead) and is reissued and signed by the associated certification authority at regular intervals.
Certificate revocation lists can reach a considerable size if the volume of revoked certificates is high (as a rule of thumb, you can expect about 5 megabytes per 100,000 entries). The regular download of large certificate revocation lists by subscribers can generate a large network load. To address this problem, there is the concept of delta CRLs.
Assume the following scenario:
Sign-in failed. Contact your system administrator and tell them that the KDC certificate could not be validated. Additional information may be available in the system event log.| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 75 (0x4B) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | MSG_E_DELTA_CRL_PUBLICATION_HOST_NAME |
| Event text (English): | Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location on server %4: %2. %3.%5%6 |
| Event text (German): | Es konnte keine Delta-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort auf dem Server "%4" veröffentlicht werden: %2. %3.%5%6 |
| Event Source: | Microsoft-Windows-CertificationAuthority |
| Event ID: | 66 (0x42) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | MSG_E_DELTA_CRL_PUBLICATION |
| Event text (English): | Active Directory Certificate Services could not publish a Delta CRL for key %1 to the following location: %2. %3.%5%6 |
| Event text (German): | Es konnte keine Delta-Zertifikatsperrliste für den Schlüssel %1 an folgendem Ort veröffentlicht werden: %2. %3.%5%6 |