You can enable the Network Detection and Response appliance to check for revoked certificates and reject them by using the appliance configuration menu:
Both the Online Certificate Status Protocol (OCSP) and the Certificate Revocation List (CRL) protocol are used to validate whether an X.509 certificate has been revoked. If the CRL is configured on the NDR appliance, the CRL is used first for certificate verification and then OCSP. By default, OCSP is enabled so that the appliance can verify the status of the certificate.
OCSP servers are also referred as OCSP responders. OCSP allows the appliance to check if a certificate has been revoked without downloading and searching the entire list. If an OCSP URL is found in the certificate, the OCSP responder is queried to determine the status of the certificate revocation. If an OCSP URL is not found in the certificate or the appliance cannot communicate with the OCSP responder from the certificate, a configured default URL is used.
A CRL contains a list of certificates that have been revoked or can no longer be trusted. When a TLS connection is set up with the appliance, part of the authentication process is to validate that the certificate is not listed in the CRL. Each entry in the list corresponds to the certificate number and the date the certificate was revoked.
Prerequisites
Admin access to the appliance.
(Optional) LDAP servers have been configured to authorize users. For details about how to configure an LDAP server, see User management .
A Certificate Authority (CA) certificate bundle has been downloaded, and an imported certificate has been added to an existing bundle from a specified URL. For details, see Configuring custom Web Server certificates.
Certificate authentication has been enabled. For details about how to enable policy settings of the Web UI, see Enabling or disabling the policy settings of the Web UI for certificate-based authentication.
A CRL file has already been installed.