Cisco ASA Series Cli Configuration Manual page 970

Configuring Digital Certificates
Storing CRLs
To establish a specific location for the automatically generated CRL of the local CA, perform the
following site-to-site task in either single or multiiple context mode:
Command
Step 1
crypto ca server
Example:
hostname (config)# crypto ca server
Step 2
cdp-url url
Example:
hostname(config-ca-server)# cdp-url
http://172.16.1.1/pathname/myca.crl
Cisco ASA Series CLI Configuration Guide
1-34
Chapter 1 Configuring Digital Certificates
Purpose
Enters local ca server configuration mode. Allows
you to configure and manage a local CA.
Specifies the CDP to be included in all issued
certificates. If you do not configure a specific
location for the CDP, the default URL location is
http://hostname.domain/+CSCOCA+/asa_ca.crl.
The local CA updates and reissues the CRL each time
a user certificate is revoked or unrevoked. If no
revocation changes occur, the CRL is reissued once
each CRL lifetime.
If this command is set to serve the CRL directly from
the local CA ASA, see the
section on page 1-33 for instructions about opening a
port on an interface to make the CRL accessible from
that interface.
The CRL exists for other devices to validate the
revocation of certificates issued by the local CA. In
addition, the local CA tracks all issued certificates
and status within its own certificate database.
Revocation checking is performed when a validating
party needs to validate a user certificate by retrieving
the revocation status from an external server, which
might be the CA that issued the certificate or a server
designated by the CA.
"Downloading CRLs"