How Windows 2000 Manages Certificate Revocation Lists

Microsoft Windows 2000 Certificate Services provides native tools to manage and distribute Certificate Revocation Lists (CRLs) to ensure invalid or compromised certificates are rejected by client systems. Managed primarily through the Certification Authority Microsoft Management Console (MMC) snap-in, Windows 2000 allows administrators to configure automated publication intervals, manually issue updated revocation lists, designate distribution points, and manage certificate revocation reasons.

The Certification Authority Snap-in

In Windows 2000, administrative control over CRLs is centralized within the Certification Authority console (certsrv.msc). This snap-in connects to the local or remote CA service, exposing key containers such as Revoked Certificates, Issued Certificates, Pending Requests, and Failed Requests. The Revoked Certificates node serves as the primary operational hub for CRL generation and schedule management.

Revoking Certificates and Assigning Reason Codes

When an administrator or automated process invalidates a certificate, it must be explicitly revoked before it appears on the next published CRL:

  1. In the Certification Authority snap-in, navigate to the Issued Certificates container.
  2. Right-click the targeted certificate, select All Tasks, and click Revoke Certificate.
  3. Choose a specific reason code from the dropdown list. Windows 2000 supports standard X.509 reason codes:
    • Unspecified
    • Key Compromise
    • CA Compromise
    • Affiliation Changed
    • Superseded
    • Cease of Operation
    • Certificate Hold (allows temporary revocation)

Once revoked, the certificate is moved to the Revoked Certificates container.

Scheduling and Publishing CRLs

A certificate remains functionally trusted by clients until the CA generates an updated CRL containing the revoked serial number and the client retrieves it. Windows 2000 manages publication both automatically and manually:

  • Configuring Publication Schedules: Right-click the Revoked Certificates folder and select Properties. Administrators can define the CRL publication interval (e.g., hours, days, or weeks). The CA automatically generates a new CRL before the current one expires based on this schedule.
  • Manual Publication: If an immediate threat occurs (such as a private key compromise), an administrator can bypass the schedule by right-clicking Revoked Certificates, selecting All Tasks, and clicking Publish. This immediately compiles a fresh .crl file reflecting all current revocations.

CRL Distribution Points (CDP)

For client systems to verify a certificate’s status, the CA embeds CRL Distribution Point (CDP) extensions into every issued certificate. In Windows 2000, CDPs are configured in the properties of the CA under the policy module settings:

  • Active Directory (LDAP): In an Enterprise CA deployment, Windows 2000 automatically publishes the CRL to Active Directory (certificateRevocationList attribute of the cRLDistributionPoint object). Domain members query LDAP to obtain updates.
  • Web Servers (HTTP): Windows 2000 integrates with Internet Information Services (IIS) to publish CRLs to an HTTP path, enabling revocation checks for non-domain or external clients.
  • File Shares (UNC/File): CRLs can be written directly to network shares for internal validation.

By default, published CRL files are stored locally in the %SystemRoot%\System32\CertSrv\CertEnroll\ directory, from which the CA handles secondary distribution to configured Active Directory and web locations.