How to make 3 separate issuing Certificate Authorities aware when a certificate has been revoked on 1 Certificate Authority?

Question

There is one offline Root CA. There are 3 issuing CAs, each on their own domain. There are domain trusts in place, but these domains are not in the same forest.

All 3 domains and CAs are managed by a different team.

These 3 issuing CAs were created for 1 application that connects to computers in all 3 domains, verifies computer's SSL certificates are valid, and performs functions on each computer. This 1 application trusts the offline Root CA and 1 of the issuing CAs.

If a certificate for a computer is revoked on 1 domain/issuing CA, how are the other 2 issuing CAs made aware of this? Is this possible?

I'm reading that all 3 issuing CAs must publish to their own CRL. Is it possible for all 3 issuing CAs to publish to the same CRL enpoint on a separate web server? If so, do the issuing CAs write/publish to the same .crl file? Or do the 3 issuing CAs publish to their own .crl file and all 3 .crl files are hosted on the same web server?

How is this generally performed?

Answer 1

Just for a visibility, the question is a cross-post from Microsoft Windows Server Security Q&A forums.

If a certificate for a computer is revoked on 1 domain/issuing CA, how are the other 2 issuing CAs made aware of this?

they aren't if they aren't part of parent-child relationship, because it's not their business. Every CA cares about revocation of any of its issuers, not siblings. CA is not required to be aware if any sibling CA ever exist.

Is this possible?

no (again, if revoked CA is not an issuer for other CAs).

Is it possible for all 3 issuing CAs to publish to the same CRL enpoint on a separate web server?

again, no. CRL is digitally signed content and is signed by the CA itself only. And when client application validates the CRL, the application checks if CRL is signed by requested issuer and invalidate the CRL if signature validation fails. That is, every CA maintains its own set of CRLs and no one else can sign it.

Or do the 3 issuing CAs publish to their own .crl file and all 3 .crl files are hosted on the same web server?

this is correct. CAs may host their CRLs on a same web server, but files are always different. Two CAs may not share same CRL location.