Understanding Windows PKI Certificate Revocation

PKI-Enabled Application Revocation Checking Support
Not all Windows PKI-enabled applications automatically perform revocation checking. Also, revocation checking is sometimes dependent on an application-specific configuration setting. Table 1 provides an overview of how the most commonly used Windows PKI-enabled applications support revocation checking.

To enable revocation checking for Secure MIME (S/MIME) in Microsoft Outlook 2000 Service Release 1 (SR1), open the registry on the client, navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography{7801ebd0-cf4b-11d0-851f-0060979387ea} registry subkey, create a new entry called PolicyFlags (of type REG_DWORD), and set its value to 00010000. To enable revocation checking for IP Security (IPSec) in Win2K Service Pack 2 (SP2) and later, open the registry, navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley registry subkey, create a new entry called StrongCrlCheck (of type REG_DWORD), and set its value to 1 or 2. This registry entry's values have the following meanings:

• 0—Disables CRL checking for certificate-based IPSec authentication.
• 1—Enables CRL checking and fails the certificate-validation process only if the CRL explicitly shows that the certificate is revoked. The client system will ignore all other failures, including when the CDP URL is unavailable.
• 2—Enables CRL checking and fails certificate validation on any CRL check errors.

Automated Revocation Checking
In the PKI world, different models are available for automated revocation checking. Most, with the exception of certificate revocation trees and the Online Certificate Status Protocol (OCSP), are based on complete CRLs, authority revocation lists, CDPs, enhanced CRLs, delta CRLs, and indirect CRLs. I don't have room to discuss all these methods, but for a good overview of automated revocation- checking methods, see Carlisle Adams and Steve Lloyd, Understanding Public-key Infrastructure: Concepts, Standards, and Deployment Considerations (Que Publishing, 1999). . . .