Delete a CRL
You can remove CRLs that were previously uploaded on the system.
This option is not available if your CRL is provisioned to the system.
Procedure
1.
In the system web interface, go to
Security
>
Certificates
.
2.
Under
Revocation
, select
Delete
next to the CRL you want to delete.
Configure the OCSP Method
You can use the OCSP method to perform certificate revocation checks on your system.
Procedure
1.
In the system web interface, go to
Security
>
Certificates
.
2.
Configure the following settings:
Setting
Description
Revocation Method
To use the OCSP revocation method, select
OCSP
.
Allow Incomplete Revocation Checks
When enabled, your system considers a revocation
check successful if there is no response or the OCSP
responder indicates a certificate’s status is unknown.
Regardless of how you configure this setting, the
following statements apply:
•
If the OCSP responder indicates a known revoked
status, your system treats it as a revocation check
failure and doesn’t allow the connection.
•
If the OCSP responder indicates a known good
status, your system treats it as a successful
revocation check and allows the connection.
Global Responder Address
Specifies the URI of the OCSP responder (for example,
http://responder.example.com/ocsp
). The
responder is used when
Use Responder Specified in
Certificate
is disabled and sometimes even when it’s
enabled. It’s recommended that you always include a
URI in this field regardless of how you configure
Use
Responder Specified in Certificate
.
Use Responder Specified in Certificate
Some certificates include the OCSP responder
address. When you enable this setting, your system
attempts to use this address (when present) instead of
the
Global Responder Address
you specified.
Note: Only HTTP URLs in a certificate’s AIA field are
supported.
3.
Select
Save
.
Securing the System
61
