smartlicense on XR devices - certificate issue

[Mark Pace Balzan]

Hi,

I have an on prem server up and running

It appears that the only way I can get a successful registration is to disable crl revocation check - this sounds wrong, even if it appears to be documented in some cisco guides.

So I need some help with some questions:

• Is it indeed correct approach (on both IOS-XE and IOS-XR) to disable crl revocation check, and if so, is this not a security issue/breach ?
• I can disable crl check in IOS-XE under the SLA-trustpoint in global config, but cant seem to find a way to do it on XR - assuming it is correct to disable crl check

My config as follows 

call-home
service active
contact smart-licensing
profile CiscoTAC-1
active
destination address http https://onprem-fqdn/Transportgateway/services/RouterRequestHandler
destination transport-method email disable
destination transport-method http
!

http client source-interface ipv4 Loopback0
license smart flexible-consumption enable

thanks for your help

Mark

[balaji.bandi]

the config seems to be correct, what is the issue? does the device not able to get License from CSSM ?

[Mark Pace Balzan]

Hi

thanks for the response - the issue should be fairly clear in my original post but let me know if you need further detail

Mark