• Editing a CRL Issuer

---

Use this page to edit or delete a CRL issuer.

Editing/Deleting a CRL Issuer

The following are the configuration options for a CRL Issuer:

1. Name - The name given by the CA Issuer.
2. Description - Enter a meaningful description for the CRL.
3. CRL Distribution URL - Enter the URL that ACS should use to retrieve the CRL. If a CA certificate contains a “CRL distribution points” parameter, this field will be populated automatically. Otherwise, be sure you specify a URL for the CRL corresponding to the CA you selected from the Issuer’s Certificate list. You can specify a URL that uses HTTP, LDAP, or FTP. Alternatively, you can specify the URL for the file itself, however this is only necessary when the repository URL lists multiple files. An example of an HTTP URL is:

   http://crl.verisign.com/pca1.1.1.crl.

   An example of an LDAP URL is:

   ldap://10.36.193.5:388/CN=development-CA,CN=acs-westcoast2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cisco,DC=com

Note: In LDAP, the default placement  for the CRL is under objectclass=crlDistributionPoint. ACS adds the object class information to the URL.  If the CRL is located elsewhere, you need to add the object class to the URL. For example, if  the CRL is situated under

 objectclass=CertificateRevocationList  

the URL should be:

ldap://10.36.193.5:388/CN=development-CA,CN=acs-westcoast2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cisco,DC=com?(objectclass=CertificateRevocationList)
 

4. Retrieve CRL —  Initially ACS attempts to download a CRL from the CA. The CRL folder and file are created in the installation directory after a CRL is successfully downloaded. The CRL issuer is not modifiable. The Next Update field in the CRL file contains a value for the Next Update.

Select the method that ACS should use for retrieving a CRL.

• Automatically — Uses the value contained in the Next Update field in the CRL file to retrieve a new CRL from the CA. If  unsuccessful, ACS tried to retrieve the CRL every 10 minutes after the first failure until it succeeds.
• Every — Determines the frequency between retrieval attempts. Enter the amount in units of time.

Note: In both modes, if retrieval fails for some reason, a reattempt is tried every 10 minutes.

5. Last Retrieve Date— This entry lists the status and the date and time of the last CRL retrieval or retrieval attempt.
6. Options — The Ignore Expiration Date check box is used to check a certificate against an outdated CRL.

   When the Ignore Expiration Date is unchecked, ACS examines the expiration date of the CRL in the Next Update field in the CRL file and continues to use this CRL even though it has expired.  If the expiry date passed, the CRL is not valid and all  EAP-TLS authentications will be rejected.

   When the Ignore Expiration Date is checked, ACS continues to use the expired CRL and permits or rejects EAP-TLS authentications according to the contents of the CRL.

   CRL is in Use — When checked, the CRL is active and is used in the EAP-TLS authentication process.

   The Submit button downloads and verifies the CRL with the public key of the issuer. If there are inconsistencies, CRL Issuer Configuration errors are generated.

   The Delete button deletes the CRL for a particular issuer.If there are inconsistencies, CRL Issuer Delete errors are generated.

   When submission succeeds, restart ACS to apply the new configuration.