Help needed with CA CRL path issue

Hakim Ismail 20 Reputation points
2026-09-03T07:56:46.63+00:00

Hello

I’m currently facing a problem where my issuing CA fails to publish Delta CRLs, causing authentication to stop for newly issued certificates. When checking the logs, I found that the system drive hosting the CertSrv\CertEnroll folder ran out of space. Could someone please guide me on how to move CRL publication paths to dedicated volumes and standardize the configuration ?

Thanks

Windows for business | Windows 365 Enterprise
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-03T07:57:11.73+00:00

    Delta CRL publication can be stabilized by moving the CA database and log files off the system drive, and by updating the CA’s CRL/CDP configuration so published CRLs use consistent locations.

    1. Back up first
      • Export the CA configuration registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration
      • This is important before changing CA settings.
    2. Move the CA database and log files to a dedicated volume
      • Warning: this requires registry changes. Incorrect registry edits can cause serious problems.
      • Stop the Certificate Services service.
      • Copy the database and log files from the default location: %SystemRoot%\System32\CertLog to the new dedicated volume.
      • Update these registry values to the new path:
        • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\DBDirectory
        • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\DBLogDirectory
        • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\DBSystemDirectory
        • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\DBTempDirectory
      • Start the Certificate Services service.
      • Check the Application event log for CertSvc event 26 to confirm the service started successfully.
      • If startup fails, verify the registry path syntax.
      • Ensure NTFS permissions on the new folder allow System full control. By default, System, Administrators, and Enterprise Administrators have full control on the CertLog folder.
    3. Standardize CRL distribution point configuration
      • Review the current CRL Distribution Point configuration with pkiview and export the configuration.
      • Configure the new CA or updated CA settings so the CRL Distribution Point settings match the required publication paths.
      • For CDP/AIA design, configure these before issuing certificates where possible, because changes to CRL distribution point URLs affect only newly issued certificates. Previously issued certificates continue to reference the original locations.
    4. Use stable and accessible CRL locations
      • Adjust the default LDAP:// and http:// URL locations on the CA Extensions tab according to operational needs.
      • Publish a CRL on an HTTP Internet or extranet location so clients outside the organization can perform certificate validation.
      • HTTP CDP locations are also recommended for non-Windows clients.
      • Windows clients retrieve CRL URLs sequentially until a valid CRL is found.
    5. Important impact for existing certificates
      • If CRL paths change, certificates already issued continue to point to the old CRL location.
      • To avoid revocation checking failures, the CA must continue publishing CRLs to the old paths as well as the new paths until all old certificates are retired.

    This addresses the disk-space issue on the system drive and helps standardize CRL publication so delta CRLs and certificate validation remain available.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Jason Nguyen Tran 25,120 Reputation points Independent Advisor
    2026-09-03T08:44:55.3233333+00:00

    Hi Hakim Ismail,

    What you’re seeing is a common scenario when the system drive hosting the CertSrv\CertEnroll folder runs out of space, since Delta CRLs can’t be written properly.

    The recommended approach is to move the CRL publication path to a dedicated volume with sufficient capacity. You can do this by updating the CA configuration using certutil -setreg CA\CRLPublicationURLs and pointing the path to a folder on the new volume. After updating, restart the Certificate Services and republish the CRLs with certutil -crl. This ensures that both base and delta CRLs are written to the new location.

    To standardize the configuration across your environment, define consistent CRL distribution points (CDPs) in the CA properties and replicate them via Group Policy so all issuing CAs follow the same publication path. It’s also a good practice to monitor disk usage on the CRL volume and set alerts before space runs low.

    In short: move the CertEnroll folder to a dedicated drive, update the CA registry settings with certutil, republish the CRLs, and align CDPs across your infrastructure. This will stabilize CRL publication and prevent future outages.

    I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

    Jason

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.