Customized CRLDP in CA

[WilliamM7]

I am trying to include a customized CRLDP in the CRLDP Extension Attribute when creating a subca. I already have checked the "Use CA defined CRL Distribution Point" in the subca certificate profile, but when the CA is issued by the root CA the CRLDP of the root CA is included in the sub ca public certificate instead. My goal is not to bind a CRLDP URI to the certificate profile, but to dynamically adjust it at creation time.

[primetomas]

Use CA defined, means that it is taken from the issuing CAs configuration of the CDP. The reason for this flag is to not have to define CDP in every certificate profile, you only have to type it in once in the CA config.

What is the use case to have a different CDP for every issued certificate? It's the first time I've heard of that.

[WilliamM7]

I have the following CA hierarchy
Root --> Issuing CA --> MQTT Client
The MQTT Broker I am using checks the signature of the CRL against the Issuing CA's public key. It needs the CRL of the Issuing CA rather than the one of the root ca. I don't understand why it is not possible to include a custom CRLDP URI at creation time (using generate).

[primetomas]

The MQTT clients CDP should always point to the Issuing CAs CRL, and the Issuing CAs CDP CRL should point to the Root CAs CRL.
End entity certificates never (as defined in RFC5280) includes a CDP to the Root CA.
In you case you should:

• In the certificate profile(s) used to issue MQTT client certificate : "Use CA defined CRL Distribution Point"

• In the configuration of Issuing CA (Edit CA) : Default CRL Distribution Point = the URL to the Issuing CAs CRLs
  With this all MQTT client certificates will point to the Issuing CA CRL, and the chain will be as it's supposed to be to follow RFC5280.

• alternatively if there is only one Certificate profile used to issue MQTT client certificates you specify that directly in 'CRL Distribution Point URI' and de-select 'Use CA defined CRL Distribution Point'

[WilliamM7]

Yes I see. I was asking myself why it did not appear in the client certificate. I forgot to check the option to include CAs defined CDP for client certificates. Thanks for the help and for calrification!