<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:51" />
    <title>CRL Downloading, Caching, and Checking Support </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1628;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1072887"> </a><h1 class="pTitle">
CRL Downloading, Caching, and Checking Support

</h1>
<a name="wp1072889"> </a><p class="pBody">
Certificate revocation lists (CRLs) are maintained by CAs to give information of prematurely revoked 
certificates, and the CRLs are published in a repository. The download URL is made public and also 
specified in all issued certificates. A client verifying a peer’s certificate should obtain the latest CRL 
from the issuing CA and use it to determine if the certificate has been revoked. A client can cache the 
CRLs of some or all of its trusted CAs locally and use them later if necessary until the CRLs expire.

</p>
<a name="wp1072890"> </a><p class="pBody">
Cisco MDS NX-OS allows the manual configuration of pre-downloaded of CRLs for the trust points, 
and then caches them in the switch bootflash (cert-store). During the verification of a peer certificate by 
IPsec or SSH, the issuing CA’s CRL is consulted only if the CRL has already been cached locally and 
the revocation checking is configured to use CRL. Otherwise, CRL checking is not performed and the 
certificate is considered to be not revoked if no other revocation checking methods are configured. This 
mode of CRL checking is called CRL optional.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
