Crl Management - Cisco TelePresence Administrator's Manual

Note: if you have enabled certificate revocation list (CRL) checking for TLS encrypted
LDAP server (for account authentication), you must add the PEM encoded CRL data to your trusted CA
certificate file.
Click Reset to default CA certificate to replace the currently uploaded file with a default list of trusted CA
n
certificates.
Click Show CA certificate to view the currently uploaded file.
n
Server certificate data
The Server certificate data section is used to upload the VCS's server certificate. This certificate is used to
identify the VCS when it communicates with client systems using TLS encryption, and with web browsers
over HTTPS.
Use the Browse buttons to select the server certificate PEM file and the server private key PEM file that
n
is used to encrypt it. After selecting both files, click Upload server certificate data. Note that the private
key must not be password protected.
Click Reset to default server certificate to replace the currently uploaded server certificate with the
n
VCS's factory default certificate.
Click Show server certificate to view the currently uploaded server certificate file in PEM format.
n
Note that the VCS stores only one server certificate file. If you have multiple certificates you must first
concatenate them into a single file before uploading them to the VCS.

CRL management

The CRL management page
configure whether the VCS uses certificate revocation lists (CRLs) when validating security certificates, and
if so, from where it obtains the CRLs.
CRL files are used by the VCS to validate certificates presented by client browsers and external policy
servers that communicate with the VCS over HTTPS.
You are recommended to upload CRL data for the CAs that sign HTTPS client and server certificates. A CRL
identifies those certificates that have been revoked and can no longer be used to communicate with the VCS.
When enabled, CRL checking is applied for every CA in the chain of trust.
You can use the Client certificate testing
n
Note that CRL data uploaded here is not used to validate TLS connections with an LDAP server for remote
n
login account authentication. CRL data for this purpose must be contained within the Trusted CA
certificate file.
Manual CRL updates
CRL files can be manually uploaded to the VCS.
To upload a CRL file:
1. Click Browse and select the required file from your file system. The CRL file must be in PEM encoded
format.
Cisco VCS Administrator Guide (X7.1)
(Maintenance > Certificate management > CRL
page to test whether or not a certificate is valid.
Maintenance
connections to an
management) is used to
Page 266 of 479