r/sysadmin•
vbman213

Building my first two-tier PKI. Questions concerning CRL.

I'm building my first two-tier PKI with a proper offline Root CA followed by an issuing subordinate CA. Currently my environment doesn't have any public IP space to serve the CRL onto the internet at large. I suspect that a proper PKI dictates that the CRL is accessible even outside of the local intranet. Until such a time that we can obtain a public IP to serve IIS from within, is it unreasonable to host the CRL from an offsite apache host?

Posted Aug 29, 2016, 11:51 PM UTC

31
Loading comments…