Re: Publish a CRL to another web site when using a Web Enrollment Prox

From: Brian Komar (
Date: 04/20/05

Date: Wed, 20 Apr 2005 16:44:36 -0500

In article <ucWoKUXRFHA.3144@tk2msftngp13.phx.gbl>,
> You can use Dfs to synchronise files between computers. Alternatively, you
> can point IIS virtual directory to a remote computer (where CRL is located).
> If using LDAP CDP in Active Directory, the information gets replicated in
> AD.
Another option is to create a script that transfers the CRL to the WEb
server. The script can use any transfer protocol and be run at regular
intervals to ensure publication

For example:
certutil -CRL
sleep 3
copy /y %windir%\system32\certsrv\certenroll\*.crt \\webserver\webshare

Run the batch file as a user that is assigned the Manage CA permissions.
Be sure to change the perms on cmd.exe to allow the BATCH account Read
and Read&Execute permissions


Brian Komar
MVP - Windows - Security