Monitoring And Maintaining Certification Authority - Cisco Catalyst 2960 series Configuration Manual

Command or Action
Step 4
end
Example:
Device(config)# end
What to Do Next
Saving Your Configuration
Always remember to save your work when you make configuration changes.
Use the copy system:running-config nvram:startup-config command to save your configuration. This
command includes saving RSA keys to private NVRAM. RSA keys are not saved with your configuration
when you use a copy system:running-config rcp: or copy system:running-config tftp: command.

Monitoring and Maintaining Certification Authority

Requesting a Certificate Revocation List
You can request a certificate revocation list (CRL) only if the certification authority (CA) does not support a
registration authority (RA). The following task applies only when the CA does not support an RA.
When a device receives a certificate from a peer, your device will download a CRL from the CA. The device
then checks the CRL to make sure the certificate that the peer sent has not been revoked. (If the certificate
appears on the CRL, the device will not accept the certificate and will not authenticate the peer.)
A CRL can be reused with subsequent certificates until the CRL expires if query mode is off. If the device
receives a peer's certificate after the applicable CRL has expired, the device will download the new CRL.
If the device has a CRL that has not yet expired, but you suspect that the contents of the CRL are out of date,
you can request that the latest CRL be downloaded immediately to replace the old CRL.
•
SUMMARY STEPS
1. enable
2. configure terminal
3. crypto pki crl request name
4. end
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
Monitoring and Maintaining Certification Authority
Purpose
Exits global configuration mode and returns to privileged
EXEC mode.
1153