Re: CAn CRL and GPO

In article <#CEz1MFOGHA.3284@xxxxxxxxxxxxxxxxxxxx>, emouchet@xxxxxxxx
says...
Hi,

I have just installed a stand-alone CA. For security, it is a stand alone
server. not integrated in my local domain.
Domain users use outlook (2000, XP, and 2003) as mailer software.
Is there a way to force Outlook to consult the CRL, published by ma
stand-alone CA.
Can I publish revocated certificates in my Active Directory or in share
directory ?
Can I use GPO ?

thanks for your help.
fabrice



I am not sure why a standalone CA would be needed for security reasons,
but...

You can publish the CRL for a standalone CA to both web and LDAP
locations, it just is not automatic as with an enterprise CA.
- To publish the CRL to Active Directory, use:
certutil -dspublish -f <CRL file> RootCA
- To publish to a web site, just use any copy protocol to copy it to the
web folder location

You must also configure the CDP and AIA extensions at the standalone CA
so that the paths are included in all certificates issued by the CA>

You do not configure Outlook to look for the CRL per se. You must enable
CRL checking in Outlook. To do this, set the UseCRLChasing registry key
at each client to a value of 1 (which is the default):

HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security
Value: "UseCRLChasing"

This DWORD value can be modified with the following values to determine
the behavior of the Outlook client software:

0 = While online, check for Certificate Revocation
1 = Check for Certificate Revocation, even when offline (this is the
default value)
2 = Never check for Certificate Revocation

Brian
.

Relevant Pages

  • Re: Certificate Revocation List (CRL) problem w/ Outlook XP
    ... Or use Outlook XP, it checks CRL by default. ... > the Signing Certificate using Outlook Clients. ... >> can turn it off via a registry hack if you like. ...
    (microsoft.public.security)
  • Re: crl.verisign.com is ok?
    ... CRL stands for Certificate Revocation List. ... certificate-signed program will check the CRL to see if the program's signature ... UNCHECKING "check for publishers certificate revocation" in your IE browser ... Update Available to Revoke Fraudulent Microsoft Certificates Issued by VeriSign ...
    (comp.security.firewalls)
  • Re: Zone alarm giving false alert?
    ... CRL stands for Certificate Revocation List. ... or by UNCHECKING "check for publishers certificate revocation" in your IE ... More information available in this Microsoft Knowledge Base article (so you can ... Update Available to Revoke Fraudulent Microsoft Certificates Issued by VeriSign ...
    (comp.security.firewalls)
  • Outlook and Outlook Express fail to read CRL
    ... I'm using Ms Outlook Express 6.0 and Ms Outlook 2002. ... When I send or receive digitally signed e-mails, clients fail to retrieve ... CRL from CDP ...
    (microsoft.public.security)
  • Re: Certificate Authority Removed
    ... Oddly the .crl part of message only showes up once a month or so in logs. ... > It looks like something is trying to get Certificate Revocation List from ...
    (microsoft.public.inetserver.iis)