Crl Distribution Point Lists - D-Link NetDefendOS User Manual

Network security firewall

Hide thumbs Also See for NetDefendOS:

Table of Contents

object that uses certificates must be assigned a Gateway and Root certificate.

Example 3.45. Associating Certificates with IPsec Tunnels

To associate an imported certificate with an IPsec tunnel.

Web Interface

Go to: Network > Interfaces and VPN > IPsec

Display the properties of the IPsec tunnel

Select Authentication

Select the X509 Certificate option

Select the correct Gateway and Root certificates

3.9.3. CRL Distribution Point Lists

NetDefendOS allows the administrator to define one or more NetDefendOS CRL Distribution Point

List (CDPL) objects. Each list is composed of one or more entries, each entry specifying the URL of

a server that can provide a Certificate Revocation List (CRL) to NetDefendOS for validating the

certificate.

To use CDPLs in NetDefendOS, the following steps are used:

Load certificates into NetDefendOS.

Define a CRL Distribution Point List.

Associate the CRL Distribution Point List with a certificate.

Once the association is made between a certificate and a CDPL, all CRL lookups for that

certificate are done using the entries in the associated CDPL. The first entry in the associated list

is tried first and if that fails the second is tried, and so on. It does not matter if the certificate has

its own embedded CDPL or not, the CDPL associated with it in NetDefendOS will always be used.

In the case of a certificate chain, only the certificate at the top of the chain needs to associated

with the CDPL defined in NetDefendOS. This CDPL will then take precedence over any CDPL

embedded in the top level certificate or any certificate at a lower level of the chain.

By forcing certificates to use the CDPL defined by the administrator instead of any CRL

embedded in the certificate, the administrator can ensure access to a functioning and accessible

Example 3.46. CRL Distribution Point List

This example creates a CDPL object called my_cdpl and associates it with a certificate called

my_cert with a single URL of http://crls.example.com. It is assumed that my_cert has already been

uploaded into NetDefendOS.

Chapter 3: Fundamentals

Show Quick Links

Table of Contents