certificates issues

[McogEsteban]

hello, i don't know if this is the right place to post this but here it goes.

i'm trying to understand a few things how certificates work on Windows.

first:
Dows Windows cache CRL's to verify the certificates and does it verifies the whole chain?
Ex: CA1 -> CA2 -> EUC (end user certificate), does windows check CA1 CRL list, CA2 and EUC?

CRL - Certificate Revocation List.

two:
Dows Windoes refeshes the CRL automatically ou do i need to download the CRL, sure Windoes can download the CRL, but i don't know where to look to activate this options.

third:
How does Windows keep and where the information contained in the CRL, i made a test downloading a CRL (using Firefox and IE).

Firefox offered the chance to make windows update the list automatically, IE didn't ...but with IE i was able to save the file, soon the installation got over, i tryed to look the file in the filesystem and i couldn't find anything, so where does Windows keeps the information contained in the list.

can some one point me to some papers, docs whatever or tell how does this works.
thanks.
cu soon.

 

[tfg13]

This might help some....

http://technet2.microsoft.com/WindowsServer/en/library/b1ee9920-d7ef-4ce5-b63c-3661c72e0f0b1033.mspx

There are some CRL download tools that actually write CRL information to the registry, but are kind of hard to get a hold of, and can make the registry huge, depending on how many CRL's you need to manage. As far as some ways around having these CRL's on your machine, how about having an OCSP responder. This is a program that basically has a "database" outside of your servers that queries this database, and provides a yes or no answer as to the validity of the client certificate.

 

[cowboychuck]

hi
very new to this. so pardon if i don't follow protocol for awhile. i am a fast learner.
does anyone have any info on i.t department duties?
would appreciate any help whatsoever.
we have been asked to come up with duties, responsibilties,
and set up policy for about a 150 employee company with 8 locations.
thanx

 

[dput]

One hint on using these discussion groups, don't add to a subject if your question is not releated to the original question. I see you have posted this question here and as a new question. This just makes it hard for everyone.

Good Luck!

Dan