Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm creating custom certificates with CDP Definitions with the option of configuring several methods of accessing the CRL. My options are HTTP, LDAP, and FTP. What are best practices or should I say why pick one vs the other?

share|improve this question
add comment

2 Answers

A CRL distribution point has the following two requirements:

  1. It must be highly available.
  2. It must be accessible for everybody.

All three protocols can be highly available implemented but the second requirement makes HTTP the preferred choice.

The technological barrier of HTTP compared to FTP or LDAP is much lower. HTTP can be accessed directly and via a proxy server. And the protocol is quite simple.

This does not apply to FTP or LDAP.

FTP can only be used in passive mode via a proxy server and the protocol is a bit more complicated and less standardized. Different servers generate different directory listings, which are sometimes incompatible to each other.

LDAP is well standardized but the implementation requires ASN.1 decoding, which is more complicated than HTTP. And there are no proxies available for LDAP in a perimeter security gateway of a typical company.

share|improve this answer
    
This is great! Thank you for your reply! –  user539120 Jan 6 '12 at 1:18
add comment

The problem with the inclusion of multiple sources is, that if one of these sources are unavailable for some reason, there are probably some clients out there who give up after trying this one wiothout trying the others. Which makes your revocation list actually less avaiable as it would be with just one (highly available) source included in the certificate.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.