Configuring Crl Objects; Using Crls - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

Configuring CRL Objects

Using CRLs

424
Refresh Frequency. Select the frequency that the device contacts the CA to obtain
a new CRL list: Daily, Weekly, or Monthly.
LDAP server. Provide the IP address of the external LDAP server that manages the
CRL.
URL address. Provide the URL address of your internal LDAP server that provides
the CRL.
OCSP—Configure the Online Certificate Status Protocol to dynamically check for
revoked certificates.
Certificate Verification.
No revoke status check for CA delegated signing cert.
URL of OCSP Responder. Provide the URL address of the OCSP server.
SCEP—Configure Simple Certificate Enrollment Protocol to get a local certificate
automatically.
CA CGI. Enter the URL address of the Certificate Authority Certificate Generation
Information.
RA CGI. Enter the URL address of the Registration Authority Certificate Generation
Information that the security device contacts to request a CA certificate.
CA IDENT. Enter the name of the certificate authority to confirm certificate ownership.
Challenge. Enter the challenge words sent to you by the CA that confirm the security
device identity to the CA.
CA Certificate Authentication. (Auto or Manual)
Polling Interval. (Poll or Do not poll).
Certificate Renewal. Define the number of times a certificate can be renewed.
Click OK to complete the CA object.
A Certificate Revocation List (CRL) identifies invalid certificates. You can obtain a CRL
file (.crl) from the CA that issued the local certification and CA certificate for the device,
then use this file to create a Certificate Revocation List object.
You must install the CRL on the managed device using NSM. Because the CRL is an object,
however, you can use the same CRL for multiple devices, as long as those devices use
local and CA certificates that were issued by that CA.
You can use a CRL object in a VPN to check for VPN members using revoked certificates.
Copyright © 2010, Juniper Networks, Inc.