|
Posted by Miha Pihler [MVP] on November 28, 2005, 3:19 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Hi,
Smartcard logon, when performed offline, does not perform a revocation check
with a CRL. It uses the cached credential verifier and it will work
indefinitely, unless the enterprise has a policy to delete or expire the
cached logons.
Other then this, CRL has its "lifetime" which is configured on CA server
(e.g. one week). After this date is reached and if you can't access new
CRL -- you can expect to run into problems.
--
Mike
Microsoft MVP - Windows Security
> We are implementing smart card logon with third-party certificates. We
> have Windows 2003 servers, Windows XP workstations and Windows 2003 CA
> (for domain controller certificates).
>
> As far as I have found out, when you log on with third-party certificates,
> domain controllers check the published CRL, which is published in
> internet. How about situation, when CRL is not available? For example, the
> CRL server or WAN link is down for some reason, or the computer where the
> user is logging on, does not have network connection (the user must have
> logged on to that computer earlier succesfully, of course).
>
> I know that in this kind of situations things work ok, for a while at
> least. But if CRL server is down, or no domain controller is available
> (cached credentials) for longer time, when can I start expecting trouble?
> Theoretically, this situation could be that a person is on a vacation or
> on a long business trip with his/her laptop, and has no connection to DC
> or CRL point for, say, two months. Would there be some kind of trouble?
>
> Are there some settings which would affect any of these?
>
> Thanks, Uljas
>
| 
XML site map