3. Revoking Certificates
Occasionally, you will need to remove a certificate from a user or computer. This is known as certificate revocation.
For example, if a user gets terminated from your organization, as an
administrator, you have the ability to revoke this user's certificate
so that they cannot access any data or confidential information after
they leave the company.
The following are some of the certificate revocation components:
Certificate revocation list (CRL)
When certificates get revoked, they are listed in the certificate revocation list (CRL).
When configured properly by an administrator, this list is used by all
the certificate servers. The CRL helps validate certificates and helps
prevent revoked certificates from being used.
CRL distribution point (CDP)
You need to publish your CRL to a shared location called a CRL distribution point (CDP). This gives your CRL a central location that all the certificate servers can share and use.
NOTE
Remember to change the URL distribution point
for the authority information access (AIA) for any new root CA. You
need to make this location accessible to all users in your
organization's network. The offline root CA's default AIA points are
not accessible to users on the network. If you do not change the
location of the AIA, certificate chain verification fails.
Online Responder
The Online Responder is the server component of
a certificate validation method called Online Certificate Status
Protocol (OCSP). When certificates get revoked, your certificate server
needs to make sure that these certificates don't get used again. You
can perform this validation in many ways. The most common validation
methods are CRLs, delta CRLs, and OCSP responses. Previous versions of
Windows Server only supported CRLs. Windows Vista and the Windows
Server 2008 operating system support both CRL and OCSP as methods for
determining certificate status. The OCSP support applies to both the
client component and the server component (called the Online Responder).
Exercise 4
walks you through the process of revoking a certificate using the
Certificate Authority MMC snap-in (this MMC is installed automatically
after the installation of your certificate server). You must have
completed Exercise 1 and 3 in order to complete this exercise.
Open the Certificate Authority MMC by selecting Start => Administrative Tools => Certificate Authority.
On
the left pane, expand the server name. Click the Issued Certificates
folder. Right-click the certificate (right pane), and in the menu,
choose All Tasks => Revoke Certificate.
In
the Certificate Revocation dialog box, you can choose the reason for
the revocation and the effective date. Choose Unspecified and enter
today's date. Click Yes. Close the Certificate Authority.
