openSSL for an organization, CRL question

[XOR != OR]

Utilizing openssl, I'd like to implement a root CA for our organization. Having never done this with openssl, I'm a bit confused as to how to setup a CRL for the organization.

Has anyone done this? Is there any documentation that I can dig through to check it out?

I am assuming a web server is involved in serving the CRL list. Is it as simple as setting up a special directory in apache to serve the CRL file?

UPDATE: Further investigations indicate that I need to configure something called a CDP when I issue certificates to my end devices. This will have the CRL location on the internal network. It appears I can use whatever protocol is available on the local workstation ( most prominent being http(s)/ldap(s) ), and that the best bet is http. This indicates that I can use a regular web server that simply serves the CRL file. Does that sound right to anyone who has done this? I plan on testing this out when I get home, but I would appreciate any feedback from those that have done this.

 

[XOR != OR]

Well, I've got the process down for generating root certificates, signing certificates and even revoking them. I still need some method for publishing the CRL to web users at least.

I have used both of the following in my root's CA ( and have verified that these settings have propagated to the clients );

nsCaRevocationURL = http://myhost/ca-crl.pem
crlDistributionPoints = URI:http://myhost/ca-crl.pem

( myhost is just a placeholder, it actually resolves )

I have checked my web server and have seen no attempts to access this file, so I am a bit lost as to how to proceed. Anybody have any pointers?

 

[XOR != OR]

Anybody have any advice?