Revocation-Check - Cisco MDS 9000 series Command Reference Manual

revocation-check

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
revocation-check
To configure trust point revocation check methods, use the revocation-check command in trust point
configuration submode. To discard the revocation check configuration, use the no form of the command.
Syntax Description
crl
none
ocsp
Defaults
By default, the revocation checking method for a trust point is CRL.
Command Modes
Trust point configuration submode.
Command History Release
3.0(1)
Usage Guidelines You must authenticate the CA and configure the OCSP URL before configuring OCSP as a revocation
checking method.
The revocation checking configuration allows one or more of the methods to be specified as an ordered
list for revocation checking. During peer certificate verification, each method is tried in the specified
order until one method succeeds by providing the revocation status. When none is specified as the
method, it means there is no need to check the revocation status, which thereby treats the peer certificate
as not revoked. If none is the first method specified in the method list, subsequent methods are not
allowed to be specified as checking is not required.
Examples
The following example shows how to check for revoked certificates using OCSP on a URL that must
have been previously configured.
switch# config terminal
switch(config)# crypto ca trustpoint admin-ca
switch(config-trustpoint)# revocation-check oscp
The following example shows how to check for revoked certificates in the locally stored CRL.
switch(config-trustpoint)# revocation-check crl
Cisco MDS 9000 Family Command Reference
20-20
revocation-check {crl [none | ocsp [none]] | none | ocsp [crl [none] | none]}
no revocation-check {crl [none | ocsp [none]] | none | ocsp [crl [none] | none]}
Specifies the locally stored certificate revocation list (CRL) as the place to
check for revoked certificates.
Specifies that no checking be done for revoked certificates.
Specifies the Online Certificate Status Protocol (OCSP) for checking for
revoked certificates.
Modification
This command was introduced.
Chapter 20 R Commands
OL-8413-07, Cisco MDS SAN-OS Release 3.x