We've got a scenario where the CRL is distributed to 2 different Locations. One ist accessable from a private network and not from the internet. The other one is asseccable from the internet but not from the private network. So to make sure that everey client (either located in the internet or in the private network) can access the CRL via http, I assume that I have to include both Locations as CRL Distribution Points in the certificate. I also assume that the Client (when checking the CRLs) is asking the 1st CRL Distribution Point first and if it does not get an "appropriate answer", it's asking the 2nd CRL Distribution Point. If it does get an "appropriate answer", it stops. Am I right until here?
What is an "appropriate answer", that makes the client stop asking next CRL Distribution Points? Does it only stop if it gets a proper CRL-File, or are there other scenarios (error codes, "not available"-messages) that make the Client stop trying "next" CRL Distribution Points?