PKI: the procedure of checking certificate revocation status and its setup - certificate

Question

Good day!
In my asp.net web application I need to check incoming digital signatures of files. I do it by calling:
SignedCms.CheckSignature(false) or SignerInfo.CheckSignature(false) (C#).
And I want to ensure, that signers’ certificates during such calls are checked for revocation correctly, ensure that system settings are correct and to clear this process for myself.
Incoming signers’ certificates maybe of large amount of CA’s. So, the signer’s certificate may or may not include references to CA’s OCSP service or CA’s CRL service.
I want the system to check revocation in such way:
IF certificate has reference to CA’s OCSP web service then the system makes the request to CA,
ELSE
IF certificate has a reference to CA’s online CRL service the system downloads CRL and uses it
ELSE
System uses the local CRL.
Could you, please, answer my questions:
how (where) can I find the system settings which describe needed behavior? (Is this behavior changable or fixed?)
If the certificate has reference to CRL web service of CA, must I download and install the CA’s CRL by script periodically, or I can rely on the system downloads and uses them automatically when it needs CRL for checking?
Thank you.

Answer 1

The procedure is described in RFC 5280 and is very complicated. In brief, you do the following:
For certificate in question, check it's signature, validity period and key usage
Check the certificate against CRL.
Check the certificate against OCSP
For each certificate encountered during CRL and/or OCSP checking, perform steps 1-3 (this in turn can involve multiple CRL and OCSP checks).
I am not mentioning policy checks, which are very complicated, here.
It took me about a month to implement certificate validator for our SecureBlackbox library (but we have everything on our own, from CRL and OCSP clients to management of those CRLs). If you want to perform certificate checking using OS means, you should be looking for existing function that does the job for you.

Answer 2

You can find some useful information on getting internals of the CRL, more specifically on the CRL caching crl-caching-in-windows-and-little-bit
There are two approaches which i am thinking here, where, windows cryptoAPI will take care of handling the revocation by itself automatically including caching. But the issue here is that cryptoAPI will look for the CA server only when the current CRL in the cache expires. So there is the difficulty of maintaining the freshness of the CRL. But if your CA's CRL publishing frequency is on a daily basis, you may get away with this approach of using CertVerifyRevocation, function call from windows with appropriate configuration for some applications.
The second approach is to download and install the CRL from the CA server and use CertFindCertificateInCRL for validation. Your CRL down-loader application can be configured to update the CRL at a predefined time interval. This will work, if the CA publishes only Base CRL, as you get the entire revoked certificate list when you download your CRL every time. I donot know the answer, to what happens if the CA publishes the Delta CRL and the Base CRL at less frequent intervals.