Cisco ASA 5505 - Manual (Page 852)

41-34
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 41 Configuring Digital Certificates
Configuring Digital Certificates
Storing CRLs
To establish a specific location for the automatically generated CRL of the local CA, perform the
following steps:
Command Purpose
Step 1 crypto ca server
Example:
hostname (config)# crypto ca server
Enters local ca server configuration mode. Allows
you to configure and manage a local CA.
Step 2 cdp-url url
Example:
hostname(config-ca-server)# cdp-url
http://172.16.1.1/pathname/myca.crl
Specifies the CDP to be included in all issued
certificates. If you do not configure a specific
location for the CDP, the default URL location is
http://hostname.domain/+CSCOCA+/asa_ca.crl.
The local CA updates and reissues the CRL each time
a user certificate is revoked or unrevoked. If no
revocation changes occur, the CRL is reissued once
each CRL lifetime.
If this command is set to serve the CRL directly from
the local CA ASA, see the
“Downloading CRLs”
section on page 41-33 for instructions about opening
a port on an interface to make the CRL accessible
from that interface.
The CRL exists for other devices to validate the
revocation of certificates issued by the local CA. In
addition, the local CA tracks all issued certificates
and status within its own certificate database.
Revocation checking is performed when a validating
party needs to validate a user certificate by retrieving
the revocation status from an external server, which
might be the CA that issued the certificate or a server
designated by the CA.