0

I have 1 ICA and 1 CRL and I would like it to serve 2 different domain in my setup. Is that possible? I'm running Windows Server 2019. Note, I'm not able to set a trust relationship between the 2 domains.

I was told that the host in the other domain won't be able to contact the CRL to verify the revocation list. Is this correct?

garethTheRed
  • 4,539
  • 14
  • 22
tosei
  • 1
  • 1
  • A generic CA will issue to any domain, as long as you don't have any name constraints. However, I suspect that, as this is MS Windows, you're asking if a single CA can _automatically enrol_ to two AD domains without setting up a trust. You need to clarify your question or it could end up being closed unfortunately. – garethTheRed May 16 '22 at 20:37
  • As @garethTheRed stated, if you're looking for the same **native conveniences** that you get within a domain/forest sans trust, probably not. That said, there's nothing to prevent an organization to customize this for external entities and it is not uncommon. The US govt has probably the largest PKI infrastructure and quite complex/elaborate. Some agencies leverage the PKI of other agencies due to cost and economies of scale. There is typically no trust between agencies, or a limited IPSEC type connection at bulkhead points. – Greg Askew May 16 '22 at 22:03
  • Thanks for the reply. Understand that there shouldn't be any constraint with signing for both domain. However, i was told that the host in the other domain won't be able to contact the CRL to verify the revocation list. Is this correct? – tosei May 17 '22 at 03:32
  • The recommendation was to use LDAP for hosting your CRL, in which case it would be difficult (although not impossible) to allow read only access to the other domain's AD. However, the current recommendation is to use HTTP instead of LDAP, in which case any relying party can access it as long as the FQDN of the host resolves in both domains. – garethTheRed May 17 '22 at 06:00

0 Answers0