How EffectiveDate (thisupdate), NextUpdate and NextCRLPublish are calculated

re: How EffectiveDate (thisupdate), NextUpdate and NextCRLPublish are calculated

MatthiasLeckel — Tue, 25 Sep 2012 16:26:31 GMT

Great article! Base CRL seems totally clear now. But Delta CRLs are stilly confusing. Where is the

CRLDeltaOverlapUnits Value actually used?

First you say:

"If the registry values are set and valid, the overlap period for a base or delta CRL is initially calculated by the CA as:

OverlapPeriod = CRLOverlapUnits * CRLPeriod"

So I assume it would be:

OverlapPeriod = CRLDeltaOverlapUnits * CRLDeltaOverlapPeriod

For Example if CRLDeltaOverlapUnits = 3 and CRLDeltaOverlapPeriod is hours then OverlapPeriod would be 3hours

But two steps further you say:"If the OverlapPeriod for a Delta CRL is calculated, the entire period of time specified as CRLDeltaPeriod and CRLDeltaPeriodUnits of the delta CRL is used:

OverlapPeriod = (CRLDeltaPeriodUnits * CRLDeltaPeriod)"

Thats confusing - here is no CRLDeltaOverlapUnits at all? Or does this line only come into play when no CRLDeltaOverlapUnits is initially set?

It would be awesome if you can underline how the OverlapPeriod in

OverlapPeriod = min(OverlapPeriod, 12 hours) - is actually calculated for DeltaCRLs

Thank You

VPN Reconnect in Windows 7 RC- redux

Adrian Dimcev's Blog — Sat, 30 May 2009 17:18:18 GMT

VPN Reconnect in Windows 7 RC- redux

re: How EffectiveDate (thisupdate), NextUpdate and NextCRLPublish are calculated

MS2065 [MSFT] — Thu, 29 Jan 2009 14:16:26 GMT

[comment] I am trying to understand how these values affect the behavior of the Crypto API CRL fetching and caching. Do you have a link or pointer you could share?

[response] The "Certificate Revocation and Status Checking" whitepaper (http://technet.microsoft.com/en-us/library/bb457027.aspx#EFAA) contains information about the Crypto API CRL fetching and caching.

[comment] Can you explain why the base CRL cannot be longer than CRLPeriodUnits * CRLPeriod?

[response] You are asking why the OverlapPeriod of a base CRL cannot be longer than CRLPeriodUnits * CRLPeriod?

The OverlapPeriod is defined as "The period by when the CRL should be renewed before it is expired." You cannot renew a CRL before it is created.

[comment] Also, a few editing comments. Can the units for the Period registry keys (CRLOverlapPeriod, CRLDeltaOverlapPeriod, CRLPeriod) also be "Days" or "Months"?

[response] No because the OverlapPeriod is limited to a max value of 12 hours.

[comment] In your first calculation of OverlapPeriod, I believe that the formula should be OverlapPeriod = CRLOverlapPeriod * CRLOverlapUnits.

[response] I have corrected this. Thanks!

[comment] Finally, threading together base CRL and delta CRL calculations makes this note harder to understand. Have I correctly understood the base CRL calculation to be as follows?

min( ( CRLOverlapUnits isvalid ? CRLOverlapUnits * CRLOverlapPeriod : CRLPeriodUnits * CRLPeriod / 10 ), CRLPeriodUnits * CRLPeriod)

[response] I assume that you are talking about the NextUpdate for a base CRL. The NextUpdate for a base CRL is calculated as stated in the blog post.

re: How EffectiveDate (thisupdate), NextUpdate and NextCRLPublish are calculated

dan2761 — Wed, 28 Jan 2009 02:34:27 GMT

Thanks for the info. I am trying to understand how these values affect the behavior of the Crypto API CRL fetching and caching. Do you have a link or pointer you could share?

Can you explain why the base CRL cannot be longer than CRLPeriodUnits * CRLPeriod?

Also, a few editing comments. Can the units for the Period registry keys (CRLOverlapPeriod, CRLDeltaOverlapPeriod, CRLPeriod) also be "Days" or "Months"? In your first calculation of OverlapPeriod, I believe that the formula should be OverlapPeriod = CRLOverlapPeriod * CRLOverlapUnits. Finally, threading together base CRL and delta CRL calculations makes this note harder to understand. Have I correctly understood the base CRL calculation to be as follows?

min( ( CRLOverlapUnits isvalid ? CRLOverlapUnits * CRLOverlapPeriod : CRLPeriodUnits * CRLPeriod / 10 ), CRLPeriodUnits * CRLPeriod)

Thanks again,

Dan