What should a CRL file name look like when "new" and "delta" CRLs are generated?

Question

I suspect my Windows 20012 Certificate Server CRL revocation configuration is incorrect every time I generate a new CRL or a new Delta, only a maximum of 3 files are generated.

1. When I created the offline root (pictured below) it generated the file ``

2. When the offline root created its first certificate it signed with the name Root01+.crt

Partial Certificate Dump of what the root added to my certificate request file from the sub (policy) CA:

 2 Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://classic.freesmime.com/Root01/Root01_.crt

I then looked on the file system and noticed that the intermediate was referencing a cert that was never created. So I went to the root CA, clicked on the node that said "revoked certificates" and hit publish.

I then had the choice to create a new CRL file or create a delta. I wasn't sure which one do to do so I did both of them (this is a test lab). I noticed that the following files were generated:

 ROOT01+.crl  (updated for Delta and new CRL)
 ROOT01.crl   (Updated only for new CRL)
 ROOT01_.crl  (Never updated ... only created when CA installed)

Question

• So my question is.. is it correct that a given CA will have a maximum of 3 CRLs with a varying suffix as listed above?

• Is it correct that a underscore name is never updated?

For those who read this far, here is an image of my CRL configuration within a MSFT offline CA:

Sorry for the large size, I'm on a Mac and think something is making the images appear too big

Answer 1

A "normal" setup with Microsoft's Certificate Services involves two CRL files: a base CRL and a delta CRL. The base CRL is destined to be referenced from a CRL Distribution Points extension in the issued certificate. The base CRL will contain a Freshest CRL extension which itself points to the delta CRL. Whenever a new base CRL is issued, a new delta CRL is issued immediately after; but the delta CRL can also be updated more often than the base CRL (and that's the point of using a delta CRL, by the way). By default, Certificate Services will force a new delta CRL whenever the previous one will soon expire, and also whenever a certificate is revoked.

You do not need more than these two files. Remember that a CRL has any value only insofar as clients (who validate certificates) can find them, and they find them by following the URL found in other objects. End-entity certificates contain one URL for CRL download, therefore the current CRL must always be stored under that name.

Furthermore, Certificate Services allows you to configure the names of both CRL (base and delta) only through a common setting, the two names differing only by the "<DeltaCRLAllowed>" keyword, which is replaced by an empty string for a base CRL, and a "+" sign for a delta CRL. That naming scheme is imposed; you cannot change it. (Incidentally, if you go for Web-based distribution of CRL and your Web server is IIS, then the "+" sign will cause you trouble; in order to allow IIS to serve the file, you have to activate double escaping.)

For the third file with an underscore, verify whether it is a ".crl" file (i.e. a CRL) or a ".crt" file (i.e. a certificate). It is normal and expected to have a copy of the CA certificate in that location. The name for that certificate will be derived (still by default) from the host name of the CA, and its domain name -- if you get nothing after the underscore, then I suppose that your CA is not part of an Active Directory domain. The CA certificate is referenced from the Authority Information Access extension of issued certificates, while CRL are referenced from the CRL Distribution Points extension of the same certificates.