And we’re back again! During PKI assessments, I regularly come across IIS servers that are used as HTTP distribution points for CRLs and CA certificates. Most of the time, the web server itself works perfectly fine. The files are there, they can be downloaded, and certificate validation succeeds. There is, however, one configuration item that I see missing surprisingly often, HTTP caching. And when caching is configured, I regularly find values that do not match the CRL publication schedule. A common example is a cache lifetime of several days while the same web server is also distributing delta CRLs that are published every 24 hours.

Continue reading