Viewing Expired CRLs
Here's what you need to know if you want to view expired certificate revocation lists (CRLs).
February 13, 2014
![white letters QA on red background white letters QA on red background](https://eu-images.contentstack.com/v3/assets/blt07f68461ccd75245/blt02578614251cd29e/661926824cba86dbd6c394da/qawebartred_5_0_4.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Q: How can I see all the certificate revocation lists (CRLs)—even those that expired—issued by my Windows Certification Authority (CA)?
A: In Windows Server 2003 and earlier, the Windows CA keeps a copy of all CRLs, including those that expired. In Windows Server 2008 and later, the Windows CA deletes the expired CRL by default when a new CRL is issued. However, you can opt to preserve expired CRLs by using the Certutil command-line utility. You just need to run these commands:
certutil -setreg CACRLFlags -CRLF_DELETE_EXPIRED_CRLSnet stop certsvcnet start certsvc
To look at the CRL information stored on your CA, you can use the command:
certutil -view -out "CRLThisPublish,CRLNumber,CRLCount" CRL
Figure 1 shows sample results.
Figure 1: Reviewing CRL Information from the Command Line
The Microsoft Management Console (MMC) Certification Authority snap-in won't display the CRL history by default. You can change this behavior if you start the Certification Authority snap-in with the /e switch, as follows:
certsrv.msc /e
Afterward, the CRL history will be displayed, as shown in Figure 2.
Figure 2: Reviewing CRL Information from the Certification Authority Snap-In
About the Author
You May Also Like