Cisco TelePresence Administrator's Manual page 281

through OCSP (Online Certificate Status Protocol) responder URIs in the certificate to be checked
n
CRL data embedded within the VCS's Trusted CA certificate file
n
The following limitations and usage guidelines apply:
when establishing SIP TLS connections, the CRL data sources are subject to the Certificate revocation
n
checking settings on the
automatically uploaded CRL files override any manually loaded CRL files (except for when verifying
n
SIP TLS connections, when both manually uploaded or automatically downloaded CRL data may be used)
when validating certificates presented by external policy servers, the VCS uses manually loaded CRLs
n
only
when validating TLS connections with an LDAP server for remote login account authentication, the VCS
n
uses CRL data within the Trusted CA certificate only
Manual CRL updates
CRL files can be uploaded manually to the VCS.
To upload a CRL file:
1. Click Browse and select the required file from your file system. The CRL file must be in PEM encoded
format.
2. Click Upload CRL file.
This uploads the selected file and replaces any previously uploaded CRL file.
Click Remove revocation list if you want to remove the manually uploaded file from the VCS.
Note that if a certificate authority's CRL expires, all certificates issued by that CA will be treated as revoked.
Automatic CRL updates
As an alternative to manually uploaded CRL files, you can configure the VCS to perform automatic CRL
updates. This ensures the latest CRLs are available for certificate validation.
To configure the VCS to use automatic CRL updates:
1. Set Automatic CRL updates to Enabled.
2. Enter the set of HTTP(S) distribution points from where the VCS can obtain CRL files. Note that:
you must specify each distribution point on a new line
l
only HTTP(S) distribution points are supported; if HTTPS is used, the distribution point server itself
l
must have a valid certificate
PEM and DER encoded CRL files are supported
l
the distribution point may point directly to a CRL file or to ZIP and GZIP archives containing CRL files
l
3. Enter the Daily update time (in UTC). This is the approximate time of day when the VCS will attempt to
update its CRLs from the distribution points.
4. Click Save.
Cisco VCS Administrator Guide (X7.2)
SIP configuration page
Maintenance
Page 281 of 498