Changing the CRL Enforcement Mode

By default, NNMi is set to enforce CRLs.

To change the product’s enforcement of CRLs, follow these steps:

  1. Edit the following file:

    Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

    Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml

  2. Within the <crl> section of the file (find the <crl> tag), search for the line that begins with the following text:

    <mode>
  3. Change the line to read as one of the following:

    <mode><value></mode>

    where <value> is one of the following:

    • ENFORCE: Enforce CRLs where specified in the certificates
    • ATTEMPT: Check CRLs but allow access if the CRL is not available
    • REQUIRE: Require and enforce CRLs in certificates

    Note In REQUIRE mode, authentication will fail if there is no CRL specified or available for a user's certificate.

  4. Save the nms-auth-config.xml file.
  5. Run the following command for the change to take effect:

    nnmsecurity.ovpl -reloadAuthConfig