Cisco Cisco Expressway
Managing certificate revocation lists (CRLs)
Certificate revocation list (CRL) files are used by the Expressway to validate certificates presented by client
browsers and external systems that communicate with the Expressway over TLS/HTTPS. A CRL identifies
those certificates that have been revoked and can no longer be used to communicate with the Expressway.
browsers and external systems that communicate with the Expressway over TLS/HTTPS. A CRL identifies
those certificates that have been revoked and can no longer be used to communicate with the Expressway.
We recommend that you upload CRL data for the CAs that sign TLS/HTTPS client and server certificates.
When enabled, CRL checking is applied for every CA in the chain of trust.
When enabled, CRL checking is applied for every CA in the chain of trust.
Certificate revocation sources
The Expressway can obtain certificate revocation information from multiple sources:
n
automatic downloads of CRL data from CRL distribution points
n
through OCSP (Online Certificate Status Protocol) responder URIs in the certificate to be checked (SIP
TLS only)
TLS only)
n
manual upload of CRL data
n
CRL data embedded within the Expressway's
Trusted CA certificate
file
The following limitations and usage guidelines apply:
n
when establishing SIP TLS connections, the CRL data sources are subject to the
Certificate revocation
checking
settings on the
SIP
configuration page
n
automatically downloaded CRL files override any manually loaded CRL files (except for when verifying
SIP TLS connections, when both manually uploaded or automatically downloaded CRL data may be used)
SIP TLS connections, when both manually uploaded or automatically downloaded CRL data may be used)
n
when validating certificates presented by external policy servers, the Expressway uses manually loaded
CRLs only
CRLs only
n
when validating TLS connections with an LDAP server for remote login account authentication, the
Expressway uses CRL data within the
Expressway uses CRL data within the
Trusted CA certificate
only
Automatic CRL updates
We recommend that you configure the Expressway to perform automatic CRL updates. This ensures that the
latest CRLs are available for certificate validation.
latest CRLs are available for certificate validation.
To configure the Expressway to use automatic CRL updates:
1. Go to
Maintenance > Security certificates > CRL management
.
2. Set Automatic CRL updates to Enabled.
3. Enter the set of HTTP(S) distribution points from where the Expressway can obtain CRL files.
Note:
l
you must specify each distribution point on a new line
l
only HTTP(S) distribution points are supported; if HTTPS is used, the distribution point server itself
must have a valid certificate
must have a valid certificate
l
PEM and DER encoded CRL files are supported
l
the distribution point may point directly to a CRL file or to ZIP and GZIP archives containing multiple
CRL files
CRL files
l
the file extensions in the URL or on any files unpacked from a downloaded archive do not matter as the
Expressway will determine the underlying file type for itself; however, typical URLs could be in the
format:
Expressway will determine the underlying file type for itself; however, typical URLs could be in the
format:
Cisco Expressway Certificate Creation and Use Deployment Guide (X8.5.2)
Page 14 of 32
Managing certificate revocation lists (CRLs)