i'm new to managing certificates using microsoft's adcs, so i apologize in advance for my lack of familiarity and expertise.
so i'm trying to test to see how quickly i can detect through ocsp that a certificate was revoked. i revoke a certificate, i run bothcertutil -url <certfilename.cer> and certutil -verify <certfilename.cer> to see how long before it shows my certificate as revoked. it's takes nearly half a day (maybe even more since i started the test close to 5pm one day and no change for the next 2 hours until i check again the next morning before i see the revocation).
so i've got a few questions.
- so when i do a check through certutil -url, it's checking my http://mysitename.com/ocsp, but where does the certutil -verify check? does it also check http://mysitename.com/ocsp or does it ldap/AD?
- when i check for certificate revocation using ocsp, what happens in the background? am i correct in thinking that the request is sent to my ocsp responder, that i've got setup under Online Responder Management -> Revocation Configuration properties -> Revocation Provider tab -> Provider... -> and the list of locations for the base/delta CRLs?
- if the check for certificate revocation using ocsp is using the list of locations for base/delta CRLs under the Revocation Provider tab mentioned above, then how does this increase the time to identify revoked certificates compared to a straight checking of the CRL?
- if the checking for the certificate revocation using ocsp is using the list of locations for base/delta CRLs under the Revocation Provider tab mentioned above, then do i need to manually update of the base/delta CRL in order for me to verify a certificate was revoked if i wanted to verify within minutes of the revocation?
- as a rewording of question number 4, how do i verify a certificate is revoked through ocsp if i wanted to verify immediately (or at a minimum within minutes) of the certificate being revoked?
- if question number 5 requires me to manually update any CRLs, how do i do that, in particular via the commandline?
i appreciate your help!