Maximum CRL Size?

[colintulloch]

What is the maximum CRL size an ASA can support?  When configuring VPN for certificate authentication, I'd like to do CRL checking, but I've heard from another customer that they hit an issue with CRLs above a few MBs.

Searching, the ONLY thing I've been able to find is a 7 year old post saying; Max 65534 entries, max size 4M

https://supportforums.cisco.com/discussion/10784511/max-crl-size-cisco-asa

[Dinesh Moudgil]

Hello colintulloch ,

Thats right. Maximum size of a single CRL: 4Mb and Maximum number of entries within a CRL: 65534

If you are getting close or above the limit, OCSP might be a smarter way than CRL.


Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[colintulloch]

I'm really surprised by this.  Is this for all versions of IOS, even newer versions can't support a larger CRL?