HTTP or LDAP for CRL

Question

Hello
I am setting up a new PKI (in a LAB initially) an reading up on the subject.
I see the default location for the CDP is in the Configuration partition in AD and therefore accessed via LDAP://......
I also see other recommending using IIS/HTTP to publish the CRL, CPS
I can see the advantage of publishing the CPS via HTTP (not sure how you would import a file e.g. text file containing the CPS into AD in any event)
Question 1:
But what are the main advantages/disadvantages of placing the CRL in an IIS site and therefore HTTP?
Question 2:
I can see how the AD integrated CA would publish updated CRL to AD as the CA is integrated (e.g. Sub issuing CA)
If the CRL is published via IIS/HTTP will the CA be able to automatically update the CRL via HTTP PUT or something like that (and if so I assume the CA Server needs rights to the Site and underlying NTFS folder containing the sites files),
or will I have to manually download the CRL from the CA and publish to the HTTP site manually (or via script)?
Question 3:
Can I have the CRL published to LDAP and HTTP at the same time, and therefore I assume I will have to update the CA in come where so when it issues certificates is states both location in the CDP information within the certificate?
Any help most appreciated
AAnotherUser__
AAnotherUser__

Answer 1

1) HTTP versus LDAP
The advantages of HTTP over LDAP/AD:
Easy anonymous access - you don't need an AD account or tweak your AD permissions, so you can serve validating apps on non-domain machines or on machines in other forests.
No replication delays (if you can use a web server in the domain, see 2) and 3)).
Can be used as 'external' and 'internal' URL, using split DNS or by publishing using a reverse proxy.
If you use the same CA for 'external' and 'internal' certificates: You do not disclose information about the structure of your AD forest to external parties.
One advantage of LDAP / AD might be the distributed structure that provides 'fail-over' - but you can use load-balanced web services with HTTP.
2) Automation of publication to an HTTP URL
You cannot use HTTP PUT unless you would write your own application for that - but you can simply share the directory the web server uses, give the CA machine account Write permissions, and add a UNC path to the list of CRL publication URLs (file:///\\webserver\share\%3%8%9.crl)
Pre-requisite: The web server needs to be member of the same or a trusted Windows domain. Otherwise you would need a script that copies or FTPs the CRL.
3) Point of time of CRL publication - LDAP vs. HTTP
If you can use the UNC path as explained before both this path and the LDAP object would be populated with the new CRL at the same time. Otherwise (web server not in a trusted domain) you would need to run the publication script more often than the CRL is
published so that there is not too much lag.
Elke