Using CRLs
A certificate revocation lists (CRL) is a file that contains a list of revoked certificates, their serial numbers, and their revocation dates. The file also contains the name of the issuer of the CRL, the effective date, and the next update date. By default, the shortest validity period of a CRL is one hour.
Some potential reasons for certificates to be revoked include:
• A CA server was hacked and its certificates are no longer trustworthy.
• A single certificate was compromised and is no longer trustworthy.
• A certificates has expired and is not supposed to be used past its lifetime.
You can upload a CRL file or specify a URL for the CRL file.
| Online certificate status protocol (OCSP) is an alternative to CRL. OCSP is useful when you do not want to deploy CRL files, for example, or want to avoid the public exposure of your PKI structure even if it is only invalid certificates. |
Before you begin:
• You must have Read-Write permission for System settings.
• You must know the URL of a CRL server or have downloaded the CRL file and be able to browse to it so that you can upload it.
To create a CRL:
1. Go to System > Certificate > Manage Certificates.
2. Click the CRL tab.
3. Click Import to display the configuration editor.
4. Complete the configuration as described in
Table 67.
5. Save the configuration.
Table 67: CRL configuration
Settings | Guidelines |
Name | Name that can be referenced by other parts of the configuration, such as www_example_com. Do not use spaces or special characters. The maximum length is 35 characters. After you initially save the configuration, you cannot edit the name. |
Import Method |
HTTP | Select to use HTTP; specify the URL. |
SCEP | Select to use SCEP; specify the SCEP URL. |
File | Browse and locate the certificate file that you want to upload. |