Crl Optional (Trustpoint) - Cisco CRS User Manual

crl optional (trustpoint)

crl optional (trustpoint)
To allow the certificates of other peers to be accepted without trying to obtain the appropriate CRL, use the
crl optional command in trustpoint configuration mode. To return to the default behavior in which CRL
checking is mandatory before your router can accept a certificate, use the no form of this command.
crl optional
no crl optional
Syntax Description
This command has no keywords or arguments.
Command Default
The router must have and check the appropriate CRL before accepting the certificate of another IP security
peer.
Command Modes
Trustpoint configuration
Command History
Release
Release 3.4.0
Usage Guidelines
When your router receives a certificate from a peer, it searches its memory for the appropriate CRL. If the
router finds the appropriate CRL, that CRL is used. Otherwise, the router downloads the CRL from either the
certificate authority (CA) or from a CRL distribution point (CDP) as designated in the certificate of the peer.
Your router will then check the CRL to ensure that the certificate that the peer sent has not been revoked. If
the certificate appears on the CRL, your router cannot accept the certificate and will not authenticate the peer.
To instruct the router not to download the CRL and treat the certificate as not revoked, use the crl optional
command.
Task ID
Task ID
crypto
Examples The following example declares a CA and permits your router to accept certificates without trying to obtain
a CRL. This example also specifies a nonstandard retry period and retry count.
RP/0/RP0/CPU0:router# configure
RP/0/RP0/CPU0:router(config)# crypto ca trustpoint myca
RP/0/RP0/CPU0:router(config-trustp)# enrollment url http://ca_server
RP/0/RP0/CPU0:router(config-trustp)# enrollment retry period 20
RP/0/RP0/CPU0:router(config-trustp)# enrollment retry count 100
RP/0/RP0/CPU0:router(config-trustp)# crl optional
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
186
Modification
This command was introduced.
Operations
read, write
Public Key Infrastructure Commands
OL-24740-01