Hello czetazate, Creating a Certificate Profile Device > Certificate Management > Certificate Profile Use CRL Select the check box to use a certificate revocation list (CRL) to verify the revocation status of certificates. Use OCSP Select the check box to use OCSP to verify the revocation status of certificates. note: If you select both OCSP and CRL, the firewall first tries OCSP and only falls back to the CRL method if the OCSP responder is unavailable. Checking the "use CRL" option should be sufficient. The caveats would be, that if the firewall can not get to the CRL imbedded in the certificate, it would be considered valid. Also, if there is no CRL in the certificate, same behavior. You can check your "service routes"(by default the MGMT port), and make sure that the firewall can get to the CRL to check the certificate status The certificate will usually tell where its corresponding CRL is hosted. You can find out from the cert where the CRL is hosted as follows: Ensure there is connectivity to the CRL link (check for general http/https connectivity, inline web proxies etc) If it is an http link, you can simply pcap on the mgmt interface going to the IP where the CRL is hosted to check if the CRL is being downloaded or not. > debug sslmgr view crl [CRL URL] > debug sslmgr statistics sslmgr statistics Count ------------------------------ ----------- Cert-status request lost 0 Cert-status request received 0 Cert-status request processed 0 Certificates revoked by CRL 0 Certificates revoked by OCSP 0 Certificates confirmed by CRL 0 Controlling GlobalProtect VPN Access with OCSP How to Configure an OCSP Responder
... View more
