To prevent access to ePO - On-prem by specific users that were configured for certificate-based authentication, add the user's client certificate to the certificate revocation list (CRL) installed on your ePO - On-prem server.
You must already have a CRL file in ZIP or PEM format.
The CRL file is a list of revoked ePO - On-prem users and their digital certificate status. The list includes the revoked certificates, the reasons for revocation, dates of certificate issue, and the issuing entity. When a user tries to access the ePO - On-prem server, the CRL file is checked and it allows or denies access for that user.
For details about product features, usage, and best practices, click ? or Help.
Select Menu → Configuration → Server Settings.
Select Certificate-based Authentication, then click Edit.
To update the CRL file, next to Certificate revocation list file, click Choose File, navigate to the CRL file, then click OK.
Click Save to save all changes.
Restart ePO - On-prem to activate certificate authentication.
ePO - On-prem checks the updated CRL file to confirm that the client certificate has not been revoked every time a user tries to access the ePO - On-prem.
You can also use the cURL command line to update the CRL file.
Note
To run cURL commands from the command line, install the cURL and grant remote access to the ePO - On-prem server.
At the cURL command-line type:
curl -k --cert <admin_cert>.pem --key <admin_key>.pem https://<localhost>:<port>/remote/console.cert.updatecrl.do -F crlFile=@<crls>.zip
In this command:
<admin_cert>— Administrator client certificate .PEM file name<admin_key>— Administrator client private key .PEM file<localhost>:<port>— ePO - On-prem server name and communication port number<crls>— CRL .PEM or .zip file name