<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:51" />
    <title>Configuring Certificate Revocation Checking Methods </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1640;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1073774"> </a><h1 class="pTitle">
Configuring Certificate Revocation Checking Methods

</h1>
<a name="wp1073775"> </a><p class="pBody">
During security exchanges with a client (for example, an IKE peer or SSH user), the MDS switch 
performs the certificate verification of the peer certificate sent by the client and the verification process 
may involve certificate revocation status checking.

</p>
<a name="wp1073776"> </a><p class="pBody">
You can use different methods for checking for revoked sender certificates. You can configure the switch 
to check the CRL downloaded from the CA (see the <a href="digicert30.html">&quot;Configuring a CRL&quot; topic</a>), you can use OSCP if 
it is supported in your network, or both. Downloading the CRL and checking locally does not generate 
traffic in your network. However, certificates can be revoked between downloads and your switch would 
not be aware of the revocation. OCSP provides the means to check the current CRL on the CA. However, 
OCSP can generate network traffic that can impact network efficiency. Using both local CRL checking 
and OCSP provides the most secure method for checking for revoked certificates.

</p>
<a name="wp1073780"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> You must authenticate the CA before configuring certificate revocation checking.

</p>
<a name="wp1119045"> </a><p class="pBody">
DCNM-SAN allows you to configure certificate revocation checking methods when you are creating a 
trust point CA. See <a href="digicert19.html">&quot;Creating a Trust Point CA Association&quot; topic</a>.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
