The following describes how to restore a CA certificate with a software key.
Restoring the certification authority certificate may be necessary for the following reasons:
All applications that use the Microsoft Cryptographic Application Programming Interface Version 2 (Crypto API Version 2, CAPI2) have a mechanism for caching certificate revocation information (certificate revocation lists and OCSP responses).
Thus, there is no guarantee that, for example, a newly published CRL will be used by participants before the previous CRL, which is still in the cache, has expired.
The following describes how to view and influence the CRL cache.
Continue reading "View and clear the address cache for certificate revocation lists (CRL URL Cache)"
If the servers providing the CRL distribution points are located in a demilitarized zone (DMZ), for example, or data transfer via Server Message Block (SMB) is not possible for other reasons, the certificate revocation lists (CRLs) can be transferred to the distribution points using SSH Secure Copy (SCP). As of Windows Server 2019, the OpenSSH server and client packages are available. The following describes the setup with authentication via public keys (Public Key Authentication) instead of passwords as an example