Microsoft CRL Partitions

In our January PKI Insights webinar, we dug into how Microsoft CRL partitioning actually behaves in real ADCS environments, including how it compares to other revocation options like delta CRLs and OCSP.

One of the most important takeaways was that certificates are permanently tied to a specific CRL partition at issuance. That design choice has long-term implications, especially if the number of partitions is changed later. As discussed during the session, reducing partitions can silently break certificate validation for certificates tied to now-orphaned CRLs, without clear warnings or guardrails.

The conversation also highlighted why CRL partitioning isn’t something to “try and see.” Once enabled, it becomes part of your revocation strategy for the life of those certificates, impacting monitoring tools, third-party products, and future PKI changes.

If you’re considering CRL partitioning—or want to understand the trade-offs before someone enables it — the full recording and Q&A provide critical context that isn’t obvious from documentation alone.

Watch the full webinar recording to hear the complete discussion and audience questions.

As certificate lifetimes continue to shrink, automation is becoming a priority for many organizations — and ACME is emerging as a key part of that conversation. In this session, we discussed how teams are approaching automation today, how ACME fits alongside existing tools and processes, and what challenges to expect in enterprise environments. We also shared early insight into Microsoft’s direction and what it could mean for future PKI strategies.