View/Delete CRL and OCSP cache

•  Any PAN-OS platform
•  Certificate deployment

• The Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP) each maintains a list of certificates which have been revoked by the Certificate Authority. If the private key associated with a certificate is lost or exposed, then any authentication using that certificate should be denied.
• Similarly, people will change jobs, names, and companies. When their certificates are replaced, the old certificates have to be marked as invalid. The purpose of the CRL and OCSP is to maintain the lists of certificates which are valid, but that have been revoked. Those lists are cached on both Management Plane (MP) and Data Plane (DP) on the firewall.

1. To view the CRL/OCSP cache:

> debug sslmgr view crl <value>
> debug sslmgr view ocsp all | <OCSP URL>

2. To delete the CRL/OCSP cache:

Note: These commands are run on the MP (management plane)

> debug sslmgr delete crl all | <CRL to delete>
> debug sslmgr delete ocsp all | <CSP cache of URL>

> debug dataplane reset ssl-decrypt certificate-status
> debug dataplane reset ssl-decrypt certificate-cache

3. To check for CRL and OCSP statistics:

> debug sslmgr statistics