Mastering Active Directory

CRL time limits

CRL also has some time limits associated:

Certutil -setreg CA\CRLPeriodUnits 13Certutil -setreg CA\CRLPeriod "Weeks"Certutil -setreg CA\CRLDeltaPeriodUnits 0Certutil -setreg CA\CRLOverlapPeriodUnits 6Certutil -setreg CA\CRLOverlapPeriod "Hours"

In the preceding commands:

• CRLPeriodUnits: This specifies the number of days, weeks, months or years CRL will be valid.
• CRLPeriod: This specifies whether CRL validity period is measured by days, weeks, months or years.
• CRLDeltaPeriodUnit: This specifies the number of days, weeks, months or years delta CRL will be valid. For offline CA, this should be disabled.
• CRLOverlapPeriodUnits: This specifies the number of days, weeks, months, or years that CRL can overlap.
• CRLOverlapPeriod ...