AD CS CRL Publication Failure Due to Large CRL Size

Yep - implementing partitioned CRLs is the recommended long-term solution when the issuing CA's CRL has exceeded 100 MB and is causing LDAP directory replication or synchronization failures. Partitioning prevents the CA from having to publish one continuously growing CRL file and keeps each individual CRL within a manageable size.

For the publication intervals, delta CRLs should be published relatively frequently, such as every 1 to 2 days, so that newly revoked certificates are distributed promptly. The base CRL can have a much longer validity and publication interval, such as several weeks or months, which reduces how frequently the large base CRL has to be regenerated and replicated. Note that changing the intervals alone is not a permanent solution because the base CRL will continue to grow as additional certificates are revoked.

Partitioned CRLs address the underlying size problem by splitting the revocation information into smaller CRLs based on certificate characteristics, such as certificate templates or key usage, rather than simply separating certificates by revocation reason. In an AD CS environment, this can be configured through the CA properties in certsrv.msc on the Extensions tab by defining additional CRL Distribution Points and associating the appropriate CDPs with specific certificate templates. Clients then retrieve the CRL partition applicable to their certificate type rather than one enormous CRL containing all revoked certificates.

More at http://learn.microsoft.com/en-au/answers/questions/5983547/crl-publication-optimization-and-partition-setup

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

This issue is usually caused by the CRL becoming too large to publish through LDAP. Check the CRL size and consider reducing stale certificates, reviewing CRL settings, or using HTTP-based CRL distribution.