You can configure certificate revocation for X.509 certificates by using the appliance CLI:
Both the Online Certificate Status Protocol (OCSP) and the Certificate Revocation List (CRL) protocol are used to validate whether an X.509 certificate has been revoked. OCSP is used as an alternative to the CRL.
OCSP servers are also referred as OCSP responders. OCSP allows the appliance to check if a certificate has been revoked without downloading and searching the entire list. If an OCSP URL is found in the certificate, the OCSP responder is queried to determine the status of the certificate revocation. If an OCSP URL is not found in the certificate or the appliance cannot communicate with the OCSP responder from the certificate, a configured default URL is used.
A CRL contains a list of certificates that have been revoked or can no longer be trusted. When a TLS connection is set up with the appliance, part of the authentication process is to validate that the certificate is not listed in the CRL. Each entry in the list corresponds to the certificate number and the date of the revoked certificate.
Admin access to the appliance.
(Optional) LDAP servers have been configured to authorize users. For details about how to configure an LDAP server, see LDAP server configuration.
A Certificate Authority (CA) certificate bundle has been downloaded, and an imported certificate has been added to an existing bundle from a specified URL. For details about how to download CA certificate bundle, see Downloading a CA certificate bundle using the CLI.
Policy settings of the Web UI have been enabled for certificate authentication. For details about how to enable policy settings of the Web UI, see Enabling or disabling the policy settings of the Web UI for certificate-based authentication.