When does ISE need to download CRL from http server or LdAP server?

[Herman2018]

Hi , anyone can please advise which scenarios ISE need to download CRL from the server? What is the purpose of CRL? Thanks in advance. 

[Mike.Cifelli]

Hi , anyone can please advise which scenarios ISE need to download CRL from the server?
-ISE can/should use CRLs to determine validity of certificate status. An example would be a certificate used in eap-tls for authentication purposes. You would want to verify that the cert is trusted and valid.
What is the purpose of CRL?
-Provides a downloadable list of revoked certificates. This list contains certs that the issuing CA has revoked before the scheduled expiration date and should no longer be trusted.
Lastly, AFAIK keep in mind that ISE cannot use delta CRLs.
HTH!

[Herman2018]

Thanks. @Mike.Cifelli . If don't use CRL, change certificate manually, is it also ok, right? 

[Mike.Cifelli]

I am not sure I follow your question. In your ISE trust store you can configure whether or not to use an OCSP profile or CRL download for the respective certificates.