Q: Can we limit the impact on our Windows Certification Authorities (CAs) from high certificate issuance load by making sure the CAs don't store certificate requests and certificates in their databases?

A: This question might come up if you want to implement Microsoft Network Access Protection (NAP) with IPsec-based access control enforcement in your organization. This configuration will have significant impact on your CAs because they will issue daily NAP access certificates to all your Windows clients.

It is possible to limit this impact in Windows Server 2008 R2, thanks to a new feature that Microsoft refers to as non-persistent certificate processing. Non-persistent certificate processing means that an enterprise Windows CA running on Windows Server 2008 R2 can be configured to process certificate requests and issue certificates without storing these in its CA database. The default Windows CA certificate processing stores a record of each certificate request and issued certificate in the CA database. A high volume of daily certificate requests such as what would be generated in NAP scenarios will significantly increase the rate at which the CA database grows. The CA database could consume all available disk space, which can ultimately result in CA unavailability.

To allow non-persistent certificate processing, you must enable the DBFLAGS_ENABLEVOLATILEREQUESTS CA database configuration option and the Do not store certificates and requests in the CA database certificate template option. The Microsoft article "How to Set Up a CA for Non-Persistent Certificate Processing" explains how to activate both of these features.

When non-persistent certificate processing is enabled, certificate revocation isn't possible because no copy of the certificate is stored in the CA database. However, when certificates have a short lifespan, certificate revocation becomes useless. Therefore, in this scenario you can also reduce PKI client-side certificate validation times by enabling the Do not include revocation information in issued certificates certificate template option