Administer > Configure NNMi to Support Public Key Infrastructure User Authentication > Certificate Validation (CRL and OCSP) > Validating Certificates Using CRLs > Changing the Location for a CRL

Changing the Location for a CRL

By default, NNMi downloads CRLs from the HTTP location embedded in the certificate. If this location is not accessible to the NNMi management server, the administrator can obtain the required CRLs some other way and configure NNMi to load those CRLs from the local file system.

Note Only CRLs signed by the certificate issuer are considered when evaluating the certificate.

To configure NNMi to load CRLs from the local file system, do the following:

  1. Edit the following file:

    Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

    Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml

  2. Within the <crl> section of the file (find the <crl> tag), search for the following text block:

    <!--

    Optional specification for the CRL location. If set NNMi will treat all certificates issued by the same CA as this CRL as having this CRL location. Multiple entries may be listed. <location>file:///var/opt/OV/shared/nnm/certificates/myco.crl</location>

    -->

  3. Insert a line after the --> tag, and enter the following, based on your operating system:

    Windows: <location>file:///C:/CRLS/<crlname>.crl</location>

    Linux: <location>file:///var/opt/OV/shared/nnm/certificates/<crlname>.crl
    </location>

  4. Save the nms-auth-config.xml file.

  5. Run the following command for the change to take effect:

    nnmsecurity.ovpl -reloadAuthConfig

Send Help Center feedback