[Contents] [Prev] [Next] [Index] [Report an Error]

Checking Certificate Validity Using CRLs

In Phase 1 negotiations, participants check the CRL list to see if certificates received during an IKE exchange are still valid. If a CRL did not accompany a CA certificate and is not loaded on the device, JUNOS software tries to retrieve the CRL through the LDAP or HTTP CRL location defined within the CA certificate itself. If no URL address is defined in the CA certificate, the device uses the URL of the server that you define for that CA certificate. If you do not define a CRL URL for a particular CA certificate, the device gets the CRL from the URL in the CA profile configuration.

Before You Begin
Obtain a certificate either online or manually. See Obtaining Digital Certificates Online or Obtaining Digital Certificates Manually . For background information, read: Public Key Cryptography for Certificates Understanding Certificates Understanding Certificate Revocation Lists Using Digital Certificates

Note: The CRL distribution point extension (.cdp) in an X509 certificate can be added to either an HTTP URL or an LDAP URL.

This topic covers:

[Contents] [Prev] [Next] [Index] [Report an Error]