There is one offline Root CA. There are 3 issuing CAs, each on their own domain. There are domain trusts in place, but these domains are not in the same forest.
All 3 domains and CAs are managed by a different team.
These 3 issuing CAs were created for 1 application that connects to computers in all 3 domains, verifies computer's SSL certificates are valid, and performs functions on each computer. This 1 application trusts the offline Root CA and 1 of the issuing CAs.
If a certificate for a computer is revoked on 1 domain/issuing CA, how are the other 2 issuing CAs made aware of this? Is this possible?
I'm reading that all 3 issuing CAs must publish to their own CRL. Is it possible for all 3 issuing CAs to publish to the same CRL enpoint on a separate web server? If so, do the issuing CAs write/publish to the same .crl file? Or do the 3 issuing CAs publish to their own .crl file and all 3 .crl files are hosted on the same web server?
How is this generally performed?