Cisco AJ732A - MDS 9134 Fabric Switch Command Reference Manual page 910

Cisco mds 9000 family command reference guide - release 4.x (ol-18089-01, february 2009)

Hide thumbs Also See for AJ732A - Cisco MDS 9134 Fabric Switch:

Table of Contents

revocation-check

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

revocation-check

To configure trust point revocation check methods, use the revocation-check command in trust point

configuration submode. To discard the revocation check configuration, use the no form of the command.

Syntax Description

By default, the revocation checking method for a trust point is CRL.

Command Modes

Trust point configuration submode.

Command History

Usage Guidelines

You must authenticate the CA and configure the OCSP URL before configuring OCSP as a revocation

checking method.

The revocation checking configuration allows one or more of the methods to be specified as an ordered

list for revocation checking. During peer certificate verification, each method is tried in the specified

order until one method succeeds by providing the revocation status. When none is specified as the

method, it means there is no need to check the revocation status, which thereby treats the peer certificate

as not revoked. If none is the first method specified in the method list, subsequent methods are not

allowed to be specified as checking is not required.

The following example shows how to check for revoked certificates using OCSP on a URL that must

have been previously configured.

switch# config terminal

switch(config)# crypto ca trustpoint admin-ca

switch(config-trustpoint)# revocation-check oscp

The following example shows how to check for revoked certificates in the locally stored CRL.

switch(config-trustpoint)# revocation-check crl

Cisco MDS 9000 Family Command Reference

revocation-check {crl [none | ocsp [none]] | none | ocsp [crl [none] | none]}

no revocation-check {crl [none | ocsp [none]] | none | ocsp [crl [none] | none]}

Specifies the locally stored certificate revocation list (CRL) as the place to

check for revoked certificates.

Specifies that no checking be done for revoked certificates.

Specifies the Online Certificate Status Protocol (OCSP) for checking for

revoked certificates.

Modification

This command was introduced.

OL-18089-01, Cisco MDS NX-OS Release 4.x