Get-CertificateRevocationList does not parse OID 2.5.29.28

[exchange12rocks]

I am not sure in what cases this OID gets populated, but one case is when you have just one CDP and it points to an HTTP location. In that case, you won't have 1.3.6.1.4.1.311.21.14, but 2.5.29.28 instead.

[Crypt32]

2.5.29.28

this OID stands for Issuing Distribution Points (IDP) extension which is used for partitioned CRLs. Although partitioned CRLs aren't supported in Microsoft Windows, ADCS supports adding IDP with default values when this setting is enabled in ADCS CDP extension:

this extension is not supported yet in PSPKI.

and 1.3.6.1.4.1.311.21.14 stands for Published CRL Locations, it is used by offline CAs when publishing to LDAP and this extension is added when the following checkbox is selected in ADCS CDP extension:

this helps certutil to find the right location in AD to publish CRL. This extension is supported by PSPKI.

In other words, these are two distinct extensions used in distinct use cases, solve different problems and aren't related to each other in any way.

[exchange12rocks]

Ah, yes, thank you for the clarification - I got confused.

[Crypt32]

I've added native support for Issuing Distribution Point CRL extension.

[Crypt32]

Fixed in v4.0.0