HP Cisco MDS 9020 Cisco MDS 9000 Family Command Reference - Cisco MDS SAN-OS R - Page 890

revocation-check Chapter 20 R Commands Send documentation comments to [email protected] revocation-check To configure trust point revocation check methods, use the revocation-check command in trust point configuration submode. To discard the revocation check configuration, use the no form of the command. revocation-check {crl [none | ocsp [none]] | none | ocsp [crl [none] | none]} no revocation-check {crl [none | ocsp [none]] | none | ocsp [crl [none] | none]} Syntax Description crl none ocsp Specifies the locally stored certificate revocation list (CRL) as the place to check for revoked certificates. Specifies that no checking be done for revoked certificates. Specifies the Online Certificate Status Protocol (OCSP) for checking for revoked certificates. Defaults By default, the revocation checking method for a trust point is CRL. Command Modes Trust point configuration submode. Command History Release 3.0(1) Modification This command was introduced. Usage Guidelines You must authenticate the CA and configure the OCSP URL before configuring OCSP as a revocation checking method. The revocation checking configuration allows one or more of the methods to be specified as an ordered list for revocation checking. During peer certificate verification, each method is tried in the specified order until one method succeeds by providing the revocation status. When none is specified as the method, it means there is no need to check the revocation status, which thereby treats the peer certificate as not revoked. If none is the first method specified in the method list, subsequent methods are not allowed to be specified as checking is not required. Examples The following example shows how to check for revoked certificates using OCSP on a URL that must have been previously configured. switch# config terminal switch(config)# crypto ca trustpoint admin-ca switch(config-trustpoint)# revocation-check oscp The following example shows how to check for revoked certificates in the locally stored CRL. switch(config-trustpoint)# revocation-check crl 20-20 Cisco MDS 9000 Family Command Reference OL-16217-01, Cisco MDS SAN-OS Release 3.x