CRL with no internet

Showing results for 
Show  only  | Search instead for 
Did you mean: 

CRL with no internet

L0 Member



I have a 440 with no internet access. I could not find documentation on the proper way to update the CRL when my firewall does have access to the internet. Thanks for any help that I might be able to get with this. 


Cyber Elite
Cyber Elite


For PKI certificates that have a CRL/OCSP host located on the internet, in case your management interface is oob and cannot access the internet, you may want to create a service route ( Device > Setup > Services > Service Route Configuration) so outbound connections to these hosts are performed using a dataplane interface instead of the management interface



Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Thank you for the reply. What if my Certs are hosted internally? Would the solution still be the same but create an inbound route? I found a solution that uses OpenSSL to merges the cert and the CRL. Have you had any experience with this solution?


Thank you for the reply. 

  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!