How do I remove the DeltaCRL location from an intermediate certificate

Question

How do I remove the DeltaCRL location from an intermediate certificate

Daniel Kaliel 1,441

Our Intermediate CA shows that a there is a DeltaCRL like. It references a list that is not copied over to the webserver host the crl because we have blocked smb file sharing. So my questions are:

Should I remove the DeltaCRL is should it be kept?
How do I remove the DeltaCRL? Unchecking publish Delta on file://xxxx did not work

James Gamble 170 Reputation points

2026-09-25T12:45:04.8+00:00

Hola Daniel,

I think there's a simpler answer here, and one important difference among the existing replies is worth clarifying. You don't need to reissue the Intermediate CA certificate just because you want that CA to stop using delta CRLs. The Intermediate CA certificate itself was issued by the parent/root CA, so its CDP extension points to the parent CA's revocation information. The Intermediate CA's own CRL configuration controls the certificates it issues.

For delta CRLs specifically, AD CS normally advertises the delta location through the "Freshest CRL" extension of the base CRL. In the Certification Authority console, that's the checkbox labeled: "Include in CRLs. Clients use this to find Delta CRL locations." Microsoft documents that distinction here.

So if your goal is to stop using delta CRLs entirely, simply unchecking "Publish Delta CRLs to this location" on the file:// entry isn't enough. That only tells the CA not to write delta CRL files to that particular publication path. It doesn't turn off delta CRL generation.

The straightforward way to turn off delta CRLs on the Intermediate CA is: certutil -getreg CA\CRLDeltaPeriodUnits

That lets you confirm the current setting. Then set the delta interval to zero: certutil -setreg CA\CRLDeltaPeriodUnits 0

Restart Active Directory Certificate Services, then publish a new base CRL: certutil -crl

Microsoft's AD CS protocol documentation specifically defines a delta CRL validity period of 0 as indicating that delta CRLs are disabled. It also describes a nice detail of the transition: when delta CRLs were previously enabled and are then disabled, the CA can publish a special "shadow" delta CRL that causes clients to retrieve a new base CRL. Microsoft documents that behavior here.

I'd still make sure the newly generated base CRL is copied to your HTTP CRL distribution point and is reachable before considering the change complete.

If, instead, you want to keep delta CRLs, the fix isn't to remove the reference. You need a reliable way to publish both the base and delta CRLs to the web location. Clients that are told a delta CRL exists need to be able to retrieve it.

Given that SMB publication to the web server has intentionally been blocked, and assuming you don't have a specific requirement for the shorter revocation interval delta CRLs provide, disabling delta CRLs and publishing a reachable base CRL is probably the cleanest design.

Thanks,

James

3 answers

Your answer

Answer 1

Keep the delta CRL only if clients need timely revocation updates and the delta CRL is actually published to an HTTP location that clients can reach. If the delta CRL URL in issued certificates points to a location that is inaccessible, certificate validation can fail for some clients and services.

For internet-facing or off-network validation, the important requirement is that the CA publishes an accessible base CRL, and if delta CRLs are used, those delta CRLs must also be published to reachable HTTP URLs. Microsoft Entra ID guidance also requires a corresponding base CRL when a delta CRL distribution point is configured.

To remove or correct the delta CRL behavior on the intermediate CA:

Open Certification Authority.
Right-click the intermediate CA, then select Properties.
Open the Extensions tab.
Set Select extension to CRL Distribution Point (CDP).
Review each CDP entry separately:
- For HTTP locations intended for clients, the documented client-facing options are:
  - Include in CRLs. Clients use this to find Delta CRL locations
  - Include in the CDP extension of issued certificates
- For file locations intended only for publishing, the documented publishing options are:
  - Publish CRLs to this location
  - Publish Delta CRLs to this location

If the problem is that the CA is trying to publish delta CRLs to a blocked file:// path, clearing only Publish Delta CRLs to this location affects publishing to that file location, but it does not remove delta CRL references from client-facing CDP entries.

To fully remove the delta CRL location from certificates, remove or update the CDP entry that clients use for delta CRLs:

In the CDP list, select the HTTP or other client-facing location that has Include in CRLs. Clients use this to find Delta CRL locations enabled.
Clear that checkbox for the entry, or remove that CDP entry and replace it with the correct reachable HTTP URL.
If needed, add a reachable HTTP CDP location and configure it appropriately.
If a file path is still needed only as a local publish target, keep the file:// entry but use only the publishing checkboxes required for your design.

Important effects:

Changes to CDP URLs affect only newly issued certificates. Previously issued certificates continue to reference the original CRL location.
If a delta CRL distribution point is configured without a corresponding base CRL distribution point, Microsoft Entra ID can return AADSTS500177.
For external clients, publish CRLs on an HTTP location accessible outside the organization.

If the goal is to stop using delta CRLs entirely on this intermediate CA, ensure that no client-facing CDP entry includes the delta CRL option, and publish only the base CRL to an accessible HTTP location.

References:

Answer 2

HLBui 13,020 Independent Advisor

Hi Daniel

Delta CRLs can be confusing when they’re hanging around but not actually being published to your web distribution point. In most environments, you don’t have to keep a DeltaCRL unless you’ve got apps or services that specifically rely on shorter revocation intervals. If you’re not publishing them to the web server and you’ve blocked SMB, then clients won’t be able to use them anyway, so it’s usually cleaner to remove them and just stick with the base CRL. The supported way to do that is to go into the CA properties, open the Extensions tab, and remove the delta CRL publication path (both file and HTTP if present). Just unchecking the “Publish Delta CRL” box isn’t always enough you may need to actually delete the delta entry from the list of CRL Distribution Points and then restart the CA service. After that, issue a new base CRL so clients have a fresh copy without delta references. Always double‑check that your applications don’t depend on delta CRLs before you make the change, but in most setups they’re optional.

Daniel Kaliel 1,441 Reputation points

2026-09-24T15:10:41.7533333+00:00

So if I uncheck Publish Delta CRLs to this location then run certutil -crl do I also need to reissue the IntermediateCA cert and distribute it to remove the reference to the delta crl?
HLBui 13,020 Reputation points Independent Advisor

2026-09-25T11:10:14.1766667+00:00

No, you don’t need to re‑issue the Intermediate CA certificate just to remove the delta CRL reference. That reference lives in the CRL distribution point extension of the cert, but clients mainly care about the CRLs you actually publish and make available. If you uncheck “Publish Delta CRLs” and then run certutil -crl, the system will generate only the base CRL, and clients will continue to work fine with that. Re‑issuing the Intermediate CA cert is only necessary if you want to completely strip the delta CRL reference from the certificate itself, but it’s not required for normal functionality. In practice, just update and distribute the base CRL and you’re good to go.

Answer 3

Daniel Kaliel 1,441

So if I uncheck Publish Delta CRLs to this location then run certutil -crl do I also need to reissue the IntermediateCA cert and distribute it to remove the reference to the delta crl?

0 comments