topic Re: Configuring CRLs in General Topics https://live.paloaltonetworks.com/t5/general-topics/configuring-crls/m-p/49214#M36248 <HTML><HEAD></HEAD><BODY><P>Hello Dan.</P><P>Checking the "use CRL" option should be sufficiant.&nbsp; The caviots would be, that if the firewll can not get to the CRL imbedded in the certificate, it would be considered valid.&nbsp; Also, if there is no CRL in the certificate, same behavior.&nbsp; You can check your "service routes"(by default the MGMT port), and make sure that the firewall can get to the CRL to check the certificate status.&nbsp; The route used for CRL is the same as OCSP.&nbsp; Hope this helps.</P><P></P><P>-chadd.</P></BODY></HTML> Mon, 11 Nov 2013 20:47:16 GMT cchristiansen 2013-11-11T20:47:16Z Configuring CRLs https://live.paloaltonetworks.com/t5/general-topics/configuring-crls/m-p/49213#M36247 <HTML><HEAD></HEAD><BODY><P>All,<BR />I am using a microsoft CA to issue machine certificates for global protect authentication.&nbsp; All is working, but the downloading of my internal CRL.&nbsp; Is there something I need to configure besides checking the "User CRL" option in my certificate profile?&nbsp; I have changed the publish time on my CA, have revoked a working cert, but still able to connect via Global Protect.&nbsp; I ran the "<SPAN style="font-size: 10pt; line-height: 1.5em;">debug sslmgr statistics" and my Certificates revoked by CRL are at 0.&nbsp; Is there something else I need to configure?</SPAN></P><P></P><P>Thanks,<BR />Dan</P></BODY></HTML> Mon, 11 Nov 2013 18:37:42 GMT https://live.paloaltonetworks.com/t5/general-topics/configuring-crls/m-p/49213#M36247 dan731028 2013-11-11T18:37:42Z Re: Configuring CRLs https://live.paloaltonetworks.com/t5/general-topics/configuring-crls/m-p/49214#M36248 <HTML><HEAD></HEAD><BODY><P>Hello Dan.</P><P>Checking the "use CRL" option should be sufficiant.&nbsp; The caviots would be, that if the firewll can not get to the CRL imbedded in the certificate, it would be considered valid.&nbsp; Also, if there is no CRL in the certificate, same behavior.&nbsp; You can check your "service routes"(by default the MGMT port), and make sure that the firewall can get to the CRL to check the certificate status.&nbsp; The route used for CRL is the same as OCSP.&nbsp; Hope this helps.</P><P></P><P>-chadd.</P></BODY></HTML> Mon, 11 Nov 2013 20:47:16 GMT https://live.paloaltonetworks.com/t5/general-topics/configuring-crls/m-p/49214#M36248 cchristiansen 2013-11-11T20:47:16Z