How to increase response time for revocation detection through OCSP

i'm new managing certificates using microsoft's adcs, apologize in advance lack of familiarity , expertise. 

so i'm trying test see how can detect through ocsp certificate revoked.  revoke certificate, run both certutil -url <certfilename.cer> , certutil -verify <certfilename.cer> see how long before shows certificate revoked.  it's takes half day (maybe more since started test close 5pm 1 day , no change next 2 hours until check again next morning before see revocation).

so i've got few questions. 

1. so when check through certutil -url, it's checking http://mysitename.com/ocsp, certutil -verify check?  check http://mysitename.com/ocsp or ldap/ad?
2. when check certificate revocation using ocsp, happens in background?  correct in thinking request sent ocsp responder, i've got setup under online responder management -> revocation configuration properties -> revocation provider tab -> provider... -> , list of locations base/delta crls?
3. if check certificate revocation using ocsp using list of locations base/delta crls under revocation provider tab mentioned above, how increase time identify revoked certificates compared straight checking of crl?
4. if checking certificate revocation using ocsp using list of locations base/delta crls under revocation provider tab mentioned above, need manually update of base/delta crl in order me verify certificate revoked if wanted verify within minutes of revocation?
5. as rewording of question number 4, how verify certificate revoked through ocsp if wanted verify (or @ minimum within minutes) of certificate being revoked? 
6. if question number 5 requires me manually update crls, how do that, in particular via commandline?

i appreciate help!

> it's takes half day (maybe more since started test close 5pm 1 day , no change next 2 hours until check again next morning before see revocation).

by default windows ocsp server relies on crl validity. say, ocsp server caches crl , uses (cached version) until crl expired. , server fetches new crl. in other words ocsp server acts mini-crls.

> check http://mysitename.com/ocsp or ldap/ad?

-verify parameter checks urls.

> , list of locations base/delta crls?

crls defined under provider dialog used ocsp server retrieve crls revocation checking purposes.

> how increase time identify revoked certificates compared straight checking of crl?

as said, ocsp server caches downloaded crls until expire.

>  do need manually update of base/delta crl in order me verify certificate revoked if wanted verify within minutes of revocation?

you can specify crl refresh intervals in provider properties.

> rewording of question number 4, how verify certificate revoked through ocsp if wanted verify (or @ minimum within minutes) of certificate being revoked?

windows ocsp responder can't guarantee revocation information availability. may need use 3rd party ocsp servers connected directly ca database. example, tumbleweed ocsp server.

> if question number 5 requires me manually update crls, how do that, in particular via commandline?

try manage crl refresh intervals in provider properties.

---

my weblog: http://en-us.sysadmins.lv
powershell pki module: http://pspki.codeplex.com
check out new: powershell fciv tool.

Windows Server  >  Security