FortiGate Administration Guide - FirewallShop.com

VPN Certificates
CRL
CRL
A Certificate Revocation List (CRL) is a list of CA certificate subscribers paired
with certificate status information. Installed CRLs are displayed in the CRL list.
The FortiGate unit uses CRLs to ensure that the certificates belonging to CAs and
remote clients are valid.
To view installed CRLs, go to VPN > Certificates > CRL.
Figure 249:Certificate revocation list
Import Import a CRL. See “Importing a certificate revocation list” on page 377.
Name
The names of existing certificate revocation lists. The FortiGate unit
assigns unique names (CRL_1, CRL_2, CRL_3, and so on) to
certificate revocation lists when they are imported.
Subject Information about the certificate revocation lists.
Delete icon Delete the selected CRL from the FortiGate configuration.
View Certificate
Detail icon
Download icon
Display CRL details such as the issuer name and CRL update dates.
See example Figure 250.
Save a copy of the CRL to a local computer.
View Certificate Detail
Download
Figure 250:CRL Certificate Detail
Importing a certificate revocation list
Certificate revocation lists from CA web sites must be kept updated on a regular
basis to ensure that clients having revoked certificates cannot establish a
connection with the FortiGate unit. After you download a CRL from the CA web
site, save the CRL on a computer that has management access to the FortiGate
unit.
Note: When the CRL is configured with an LDAP, HTTP, and/or SCEP server, the latest
version of the CRL is retrieved automatically from the server when the FortiGate unit does
not have a copy of it or when the current copy expires.
To import a certificate revocation list, go to VPN > Certificates > CRL and select
Import.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 377