Best practice to allow outbound access to all major CRL Distribution Points

[Anthony_Vita]

What is the best practice for allowing outbound access to public CRL Distribution points?

[Chris_Atkinson]

Are you doing this today with a rule permitting the OCSP object with destination Internet or some other approach?

[Anthony_Vita]

Yes, I am already doing this for one of the many CRL Dist Points.  I was wondering if there was something like an updateable object that could be referenced to allow access to all/many of the CRL DP's out there?

[PhoneBoy]

Not to my knowledge.
Given the number of CAs out there (and their various Sub-CAs), I don't believe the creation and maintenance of such an object is practical.

[the_rock]

I second what Chris said, thats best way, at least that I know of.