If your CA stores its current CRL at its Lightweight Directory Access Protocol (LDAP) server, you can optionally check your CA CRL list before using a digital certificate. If the digital certificate appears on the CA CRL, your router cannot use it. To access your CA CRL, include the ldap-url statement at the [edit security certificates certification-authority ca-profile-name] hierarchy level:
- [edit security certificates certification-authority ca-profile-name]
-
ldap-url url-name;
url-name is the certification authority LDAP server name. The format is ldap://server-name, where server-name is the CA host DNS name or IP address.