Change CRL location for internal clients

hello,

when a client computer wants to perform CRL check against a public CA's CRL,
it must connect to the CA's HTTP CRL location over a company firewall. The
firewall actually blocks the ougoing requests to the internet where the CRL
location lies.

Is it possible to somehow make the clients (XP, Vista, 2008) download the
CRLs from some internal URL which would be different from the one found in
certificate's CDP location?

thank you very much.

ondrej.

Ondrej Sevecek napisal:
> hello,
>
> when a client computer wants to perform CRL check against a public CA's
> CRL, it must connect to the CA's HTTP CRL location over a company
> firewall. The firewall actually blocks the ougoing requests to the
> internet where the CRL location lies.
>
> Is it possible to somehow make the clients (XP, Vista, 2008) download
> the CRLs from some internal URL which would be different from the one
> found in certificate's CDP location?
>
> thank you very much.
>
> ondrej.
>
>

AFAIK you can't change CRL distribution point, but a workaround is possible. You
can setup DNS record in your internal DNS server and make that record point to
your internal location.

Feel free to ask more questions if needed.

HTH

Martin

--
Replace nospam with google's mail for e-mail communication

thank you very much. this has already occured to me, but I just wanted a
confirmation that there is no other way how to achieve it.

o.



"Martin Rublik" <> wrote in message
news:...
> Ondrej Sevecek napisal:
>> hello,
>>
>> when a client computer wants to perform CRL check against a public CA's
>> CRL, it must connect to the CA's HTTP CRL location over a company
>> firewall. The firewall actually blocks the ougoing requests to the
>> internet where the CRL location lies.
>>
>> Is it possible to somehow make the clients (XP, Vista, 2008) download
>> the CRLs from some internal URL which would be different from the one
>> found in certificate's CDP location?
>>
>> thank you very much.
>>
>> ondrej.
>>
>>
>
> AFAIK you can't change CRL distribution point, but a workaround is
> possible. You
> can setup DNS record in your internal DNS server and make that record
> point to
> your internal location.
>
> Feel free to ask more questions if needed.
>
> HTH
>
> Martin
>
> --
> Replace nospam with google's mail for e-mail communication