Understanding Windows PKI Certificate Revocation

One of the most important aspects in the design of a public key infrastructure (PKI) is certificate revocation or, more specifically, automated revocation checking. Certificate revocation ensures that the PKI system adds a certificate's serial number to a blacklist, called the certificate revocation list (CRL), when a PKI user's private key is compromised. Certificate revocation also guarantees that the PKI system efficiently distributes the revocation information to all PKI clients and PKI-enabled applications. If your PKI systems need to handle confidential or valuable information or transactions, you'll need to understand the process of revoking a certificate, Windows PKI-enabled application revocation checking support, and automated revocation-checking solutions. Let's begin by taking a closer look at CRLs.

Certificate Revocation Lists
The International Telecommunications Union Telecommunication Standardization Sector (ITU-T) X.509 standard and Internet Engineering Task Force (IETF) Request for Comments (RFC) 2459 define a CRL, which contains a timestamped list of revoked certificates that the Certification Authority (CA) signs and makes available to PKI users in a public repository. A CRL identifies each revoked certificate by its certificate serial number. The X.509 standard defines two primary types of CRLs: complete CRLs and delta CRLs. . . .