IPA/IdM Certificate Revocation Lists (CRLs) Can be Inconsistent Across IPA/IdM Masters and Replicas

Issue

• It was found that the current default configuration of IPA servers did not publish correct CRLs (Certificate Revocation Lists). The default configuration specifies that every replica is to generate its own CRL, however this can result in inconsistencies in the CRL contents provided to clients from different Identity Management replicas. More specifically, if a certificate is revoked on one Identity Management replica, it will not show up in the CRL on another Identity Management replica.