SSL Initiation Server Certificate CRL check

[eddiemeijer]

I got the SSL initiation setup working with the backend-server setup. The cleint certificate is checked via the CRL because there is CDP information in the certificate.

However we like to validate also the servercertificate. When we use a ssl-server configuration you can put in the ssl-server 10 crl xx command, this can not be done in a backend-server config. Anybody an Idea how the check the servercertificate against a CRL.

[thomas.chen]

I hope you mean that to do full authentication by checking CRL and Certificate ACLs. ssl module can do certificate caching to improve performance. Cat6k ssl module can do both client certificate authentication and server certificate authentication in ssl initiation case.Check with the below links for more information.

CRL

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/cfgnotes/ssl_2_1/ssl_cfg/config.htm#1252254

Certificate ACL

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/cfgnotes/ssl_2_1/ssl_cfg/config.htm#1252138

Certificate caching

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/cfgnotes/ssl_2_1/ssl_cfg/config.htm#1252599

Server Certificate authentication

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/cfgnotes/ssl_2_1/ssl_cfg/config.htm#1280161