ipsec using certificates

[dragec]

If I have remote locations using site-to-site ipsec tunnels with central location (PIX) and if I want to use certificates, after certificates are issued and distributed to all perticipients, do they have to have live connection to CA or this connection is not nessesary?

thanks!

[r-simpson]

I don't think you need live connetions to CA, but the CRL should be available to check the validty of the Certificates.