What is the default behavior when a Certificate Profile is configured to use both CRL and OCSP?

CRL is generally considered a fallback mechanism or an alternative when OCSP is unavailable, not the preferred method by default when both are present.

While timeout values are configurable, the preference between OCSP and CRL is a default setting based on the protocol's characteristics, not dynamically determined by the lower timeout value.

The firewall does not simply use the "first profile to respond"; it follows a predefined order of preference, with OCSP being prioritized by default for efficiency and real-time status.

By default, Palo Alto Networks firewalls prefer OCSP for certificate revocation checks over CRL when both are configured because OCSP provides real-time revocation status and is generally more efficient than downloading and parsing large CRL files.