aaa authentication certificate crl fetch url ＜URL＞

Downloads a local Certificate Revocation List (CRL) file from a specified remote location so that the appliance can validate certificate revocation. Only one CRL file can be present on the system. When you download a new CRL file, the existing CRL file will be automatically deleted.

A CRL contains a list of certificates that have been revoked or can no longer be trusted. When a TLS connection is set up with the appliance, part of the authentication process is to validate that the certificate is not listed in the CRL. Each entry in the list corresponds to the certificate number and the date of the revoked certificate.

Note

If you do not specify a filename, the CRL file will be saved to the appliance or node locally and the remote filename will be used.

For details about certificate revocation, refer to the "Configuring CAC for Certificate Authentication" appendix of the System Administration Guide.

Note

This command is not currently used on the Intelligent Virtual Execution - Server compute node.

Syntax

aaa authentication certificate crl fetch url <URL> [filename <name_of_file>]

Parameters

URL

Direct path to the certificate file. The <url> is specified with remote server Administrator credentials (<username> and <password>), the remote server (<hostname>), the path and filename in which to save the certificate bundle (<path/filename>) in the following format: scp://<username>[:<password>]@<hostname>/<path/filename>If you do not specify the remote host administrator password in the aaa authentication certificate crl fetch url command (where the password would be visible as clear text), the CLI prompts for the password and obfuscates the keyboard input as you type it.

filename

(Optional) Saves the CRL file that you downloaded.

name_of_file

(Optional) Name of the saved CRL file.

Example

The following example shows how to download a local CRL file from a specified remote location.

hostname (config) # aaa authentication certificate crl fetch url http://172.16.142.99/QA/test/cac/john-doe.crl.pem 

User role

Admin

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later: