I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated.
When I created the offline root (pictured below) it generated the file ``
When the offline root created its first certificate it signed with the name
Partial Certificate Dump of what the root added to my certificate request file from the sub (policy) CA:
2 Authority Info Access Access Method=Certification Authority Issuer (220.127.116.11.18.104.22.168.2) Alternative Name: URL=http://classic.freesmime.com/Root01/Root01_.crt
I then looked on the file system and noticed that the intermediate was referencing a cert that was never created. So I went to the root CA, clicked on the node that said "revoked certificates" and hit publish.
I then had the choice to create a new CRL file or create a delta. I wasn't sure which one do to do so I did both of them (this is a test lab). I noticed that the following files were generated:
ROOT01+.crl (updated for Delta and new CRL) ROOT01.crl (Updated only for new CRL) ROOT01_.crl (Never updated ... only created when CA installed)
So my question is.. is it correct that a given CA will have a maximum of 3 CRLs with a varying suffix as listed above?
Is it correct that a underscore name is never updated?
For those who read this far, here is an image of my CRL configuration within a MSFT offline CA:
Sorry for the large size, I'm on a Mac and think something is making the images appear too big