Technical Tip: FortiGate strict CRL check
Description
This article describes how to make the FortiGate denies access to a website having a revoked certificate.
Useful links:
- Fortinet Documentation here.
Solution
By keeping the default configuration, the FortiGate allows access to external resources possessing revoked certificate.
FortiGate does not perform a strict CRL check by default.
The following configuration will make the FortiGate perform a strict CRL check:
config vpn certificate settingIn order to test the configuration, access here.
set ocsp-status enable
set ssl-ocsp-status enable
set ssl-ocsp-option certificate
set strict-crl-check enable
set strict-ocsp-check enable
end
