I'm creating custom certificates with CDP Definitions with the option of configuring several methods of accessing the CRL. My options are HTTP, LDAP, and FTP. What are best practices or should I say why pick one vs the other?
A CRL distribution point has the following two requirements:
All three protocols can be highly available implemented but the second requirement makes HTTP the preferred choice.
The technological barrier of HTTP compared to FTP or LDAP is much lower. HTTP can be accessed directly and via a proxy server. And the protocol is quite simple.
This does not apply to FTP or LDAP.
FTP can only be used in passive mode via a proxy server and the protocol is a bit more complicated and less standardized. Different servers generate different directory listings, which are sometimes incompatible to each other.
LDAP is well standardized but the implementation requires ASN.1 decoding, which is more complicated than HTTP. And there are no proxies available for LDAP in a perimeter security gateway of a typical company.
The problem with the inclusion of multiple sources is, that if one of these sources are unavailable for some reason, there are probably some clients out there who give up after trying this one wiothout trying the others. Which makes your revocation list actually less avaiable as it would be with just one (highly available) source included in the certificate.