PCNSE · Question #289
Which two methods can be configured to validate the revocation status of a certificate? (Choose two.)
The correct answer is A. CRL C. OCSP. Two standard protocols exist to check whether a certificate has been revoked before its expiration date: (1) CRL (Certificate Revocation List) - the firewall periodically downloads a signed list of revoked certificate serial numbers from a CA-hosted distribution point; (2) OCSP…
Question
Which two methods can be configured to validate the revocation status of a certificate? (Choose two.)
Options
- ACRL
- BCRT
- COCSP
- DCert-Validation-Profile
- ESSL/TLS Service Profile
How the community answered
(15 responses)- A93% (14)
- E7% (1)
Explanation
Two standard protocols exist to check whether a certificate has been revoked before its expiration date: (1) CRL (Certificate Revocation List) - the firewall periodically downloads a signed list of revoked certificate serial numbers from a CA-hosted distribution point; (2) OCSP (Online Certificate Status Protocol) - the firewall queries an OCSP responder in real time to check the revocation status of a specific certificate. PAN-OS supports both and allows them to be configured within a Certificate Profile. CRT is not a revocation method (it refers to a certificate file format). 'Cert-Validation-Profile' and 'SSL/TLS Service Profile' are PAN-OS configuration objects that consume these methods but are not themselves revocation protocols.
Topics
Community Discussion
No community discussion yet for this question.