About certification verification
A certificate is automatically verified when it is requested, obtained, or used by an application. If the certificate expires, if it is not issued by a trusted CA, or if it is revoked, the certificate cannot be used You can also manually verify a certificate.
You can enable or disable CRL checking in a PKI domain. CRL checking checks whether a certificate is in the CRL. If it is, the certificate has been revoked and its home entity is not trusted.
To use CRL checking, a CRL must be obtained from a CRL repository. The device selects a CRL repository in the following order:
CRL repository specified in the PKI domain by using the crl url command.
CRL repository in the certificate that is being verified.
CRL repository in the CA certificate or CRL repository in the upper-level CA certificate if the certificate being verified is a CA certificate
If no CRL repository is found after the selection process, the device obtains the CRL through SCEP. In this scenario, the CA certificate and the local certificates must have been obtained.
A certificate fails CRL checking in the following situations:
A CRL cannot be obtained during CRL checking of the certificate.
CRL checking verifies that the certificate has been revoked.