CRL and AIA distribution points done right

The CDP (where to fetch the revocation list) and AIA (where to fetch the issuer's cert) are stamped into every certificate at issuance. Get them wrong at setup and you are reissuing the whole chain later. The rule: always include an HTTP location, and put it first.

Why not LDAP-only

The default AD CS config publishes CDP/AIA to LDAP. Domain members are fine, but anything off-domain, a Mac, a phone, a partner, cannot read LDAP and will fail revocation checking. HTTP works for everyone, so it should be the primary URL.

Set the URLs

certutil -setreg CA\CRLPublicationURLs ^
 "1:C:\Windows\System32\CertSrv\CertEnroll\%3%8%9.crl\n2:http://pki.corp.example.com/crl/%3%8%9.crl"

certutil -setreg CA\CACertPublicationURLs ^
 "1:C:\Windows\System32\CertSrv\CertEnroll\%1_%3%4.crt\n2:http://pki.corp.example.com/crl/%1_%3%4.crt"

net stop certsvc && net start certsvc
certutil -crl

Verify the chain

certutil -verify -urlfetch server.cer

That command fetches every URL in the chain and tells you exactly which CDP/AIA is reachable and which is not. If a client complains a cert is "revoked" and it is not, it usually means it could not reach the CRL, so it fails closed.