[MS-WCCE] v52 §3.2.1.4.3.2.41 unclear CR_PROP_CERTCDPURLS behavior

Vadims Podāns 9,266 Reputation points MVP
2025-08-28T08:24:49.4733333+00:00

In [MS-WCCE] §3.2.1.4.3.2.41, CR_PROP_CERTCDPURLS returns an array of CDP URLs to be included in issued certificate based on CA key index, which is identified by PropIndex parameter. However, it is unclear the behavior of this parameter when both Config_CRLPartition_Enabled and Config_CRLPartition_PartitionZero_Exclusive are set to TRUE.

CR_PROP_CERTCDPURLS parameter is supposed to return exact CDP URLs by dynamically resolving <CRLNameSuffix> variable. But when previous conditions are TRUE, then CR_PROP_CERTCDPURLS is broken, because it will not return exact partition index if no other means are used. Though, looking at §3.2.1.4.3.2.47 CR_PROP_PARTITIONED_BASECRLPUBLISHSTATUS, other means are available: PropIndex is split into two USHORTs to separately identify CA key index and partition index. Which leads me to an assumption, that CR_PROP_CERTCDPURLS works same way: I can specify both, CA key index and CRL partition index to get an array of correct URLs and documentation wasn't properly updated.

However, if my assumption is wrong and documentation is correct, then please explain how CR_PROP_CERTCDPURLS works when both Config_CRLPartition_Enabled and Config_CRLPartition_PartitionZero_Exclusive are set to TRUE. As I understand, it is not possible to construct exact URL without specifying partition index.

Windows development | Windows Open Specifications
Answer accepted by question author
Sreekanth Nadendla 796 Reputation points Microsoft Employee Moderator
2025-09-09T17:25:51.2166667+00:00

Hello Vadims,

The CR_PROP_CERTCDPURLS property always returns the CDP URLs of partition zero and does not interpret the partition index even if it is passed as higher USHORT. We will need to add a new property similar to CR_PROP_PARTITIONED_BASECRLPUBLISHSTATUS to support this. Additionally, when Config_CRLPartition_PartitionZero_Exclusive is set to TRUE, the CDP URLs with <CRLPartitionIndex> are returned as-is. This behavior is intentional, ensuring that the returned URLs remain inaccessible for the following reason:

CR_PROP_CERTCDPURLS returns an array of CDP URLs that clients can use to download the CRLs. Clients try the URLs in a particular order until they find an URL that's accessible. They do not attempt all URLs or scan all the CRLs when determining revocation status. Therefore, it would be incorrect to return only the CDP URL of partition zero when it's configured to be exclusive. Instead, this must be provided through a new property, ensuring that clients are explicitly aware they are contacting a CA with CRL partitioning enabled and that partition zero CRL does not represent the full CRL. This new property would also allow you to download the CDP URLs of all other partitions. At present, however, we do not see a need to implement this.

Regards,

Sreekanth Nadendla

Microsoft Windows open specifications

Was this answer helpful?

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.