Should Subordinate CAs on separate domains point to one location for CDP and AIA?

Question

I'm a bit confused with how CRLs and AIAs work. I am on a domain B and I have been tasked with building a Subordinate CA that has an offline Root CA located in Domain A perimeter. These domains are not in the same forest. There is a trust.

Domain A has an offline Root CA and a Subordinate CA. A Subordinate CA in Domain A, B, C, and D will all use Domain A's Root CA.

How should CDPs and AIAs be handled in this situation? Should CDPs and AIAs be published in one location such as a web server in Domain A?

When building my Sub CA in my Domain B, do I enter in CDP and AIA locations pointing to the web server located on Domain A? Or can I leave the default locations (within the Extensions tab) and this will be done automatically?

Should I be hosting my own CRL and AIA?

Answer 1

It's up to you. In some cases, it is reasonable to use centralized storage for certificates and CRL. If CAs maintained by different teams, it may be reasonable to have dedicated storage for every CA. The only requirement is that the URL must be resolvable and reachable by all certificate clients that perform certificate validation.

I would recommend to check my blog post on this subject: Designing CRL Distribution Points and Authority Information Access locations that contains additional considerations and recommendations.