> # Peer Certificate Verification

> The PKI support on an MDS switch provides the means to verify peer certificates. The switch verifies certificates presented by peers during security exchanges pertaining to applications, such as IPsec/IKE and SSH. The applications verify the validity of the peer certificates presented to them. The peer certificate verification process involves the following steps:

> - Verifies that the peer certificate is issued by one of the locally trusted CAs.
> - Verifies that the peer certificate is valid (not expired) with respect to current time.
> - Verifies that the peer certificate is not yet revoked by the issuing CA.

> For revocation checking, two methods are supported: certificate revocation list (CRL) and Online Certificate Status Protocol (OCSP). A trust point uses one or both of these methods to verify that the peer certificate has not been revoked.

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.