ISE 2.4: Can you configure multiple "CRL Distribution URL"s per trusted certificate?

[Nadav]

Hi everyone,

If I'd like to check more than one FQDN for a CRL prior to authenticating a trusted certificate, is this supported? As far as I can tell the documentation doesn't define this field as a list but as a single URL. 

Example:  myCDP1.mydomain.com/CRL.crl, myCDP2.mydomain.com/CRL.crl

Thanks!

[hslai · Accepted solution]

This is not currently support. I got validation error when attempting to squeeze in multiple URIs into a single text field.

[Nadav]

Thanks for the quick reply.

That's unfortunate, it can mean a single point of failure for any communication based on that trusted certificate (including dot1x and secure syslog).

Any idea how this can be remediated without a load balancer? 

[hslai]

I think it possible to do DNS load balancing or AnyConnect, although I have not personally configured either.