How can I use an HTTP CRL on Cisco IOS?

Question

On a Cisco 867 running IOS 15.6(3)M7, I'm trying to do the following:

TEST-GW1(config)#crypto pki trustpoint vpn-p2s-server-11 
TEST-GW1(ca-trustpoint)#crl query http://myvpn/crls/21.crl
% URL must begin with ldap://

I've found this post: https://community.cisco.com/t5/other-security-subjects/crl-request-via-ldap-on-c2611/td-p/214237 which seems to describe the same problem and suggests that there might be a flag or field I need to set differently in the trustpoint certificate, but I can't work out what it is I'd need to change there to allow an HTTP CRL endpoint for the trustpoint.

Additionally, I've found this: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_0100.pdf which at the top of page 5 shows an example using the same commands that I've used in my example above where an HTTP CRL endpoint works.

The trustpoint certificate that was imported includes an HTTP CRL endpoint already and as far as I can tell, no mention of LDAP.

What do I have to do to allow the HTTP CRL lookup to be used on that trustpoint?

Edit:

The certificate I'm importing does have an HTTP CRL Distribution point in it already, but doesn't show up in the CRLs list:

HOST#show crypto pki certificates
  Certificate
  Status: Available
  Certificate Serial Number (hex): 00EA9801
  Certificate Usage: General Purpose
  Issuer: 
    cn=Test Intermediate CA
    o=MyVPN
    c=NZ
  Subject:
    Name: test.vpn.local
    cn=test.vpn.local
    o=MyVPN
    c=NZ
  CRL Distribution Points: 
    http://myvpn/crls/21.crl
  Validity Date: 
    start date: 13:22:25 NZST Apr 23 2020
    end date: 13:22:25 NZST Apr 23 2023
  Associated Trustpoints: vpn-p2s-server-11 
  Storage: nvram:myvpntest#8B45.cer

HOST#show crypto pki crls
HOST#

Answer 1

Not sure if I can help you with the command directly, but i can show you another way of checking CRLs within a trustpoint. See following configuration:

Router(config)#crypto pki trustpoint INTERNALCA
Router(ca-trustpoint)#vrf LAN
Router(ca-trustpoint)#fqdn router.company.local
Router(ca-trustpoint)#subject-name CN=router.company.local,O=COMPANY,OU=BRANCH,ST=AT,L=HUSTON,C=US
Router(ca-trustpoint)#rsakeypair roRZ101
Router(ca-trustpoint)#revocation-check crl <------------ important command
Router(ca-trustpoint)#enrollment terminal pem
Router(ca-trustpoint)#fingerprint 3fff1121ac19736fcbaeb6f0244d34d64ee4cb3b
Router(ca-trustpoint)#exit

If you then, import a certificate into the router based on this trustpoint, you need to have the CRL URLs within the certificate. In a windows environment, you would usually have 2 URLs. One LDAP which is used for internal windows clients and a HTTP which can be used for other clients internally or externally. You would then need to make sure this CRL is frequently uploaded from your CA to the Server where it would be reachable via the URL. If you check the certifiate on the router, you can see the embedded CRL URLs:

Router#show crypto pki certificates INTERNALCA
Certificate
  Status: Available
  Certificate Serial Number (hex): 110000001D082B67CDE01F7B4100000000001D
  Certificate Usage: General Purpose
  Issuer: 
    cn=COMPANY Root Certificate Authority
    ou=IT
    o=COMPANY
    c=US
  Subject:
    Name: router.company.local
    cn=router.company.local
    ou=BRANCH
    o=COMPANY
    l=HUSTON
    st=AT
    c=US
  CRL Distribution Points: 
    http://ca.company.com/Root%20Certificate%20Authority.crl
    ldap:///CN=Root%20Certificate%20Authority,CN=SERVER02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=company,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint
  Validity Date: 
    start date: 11:33:08 CET Mar 23 2018
    end   date: 11:33:08 CET Mar 20 2028
  Associated Trustpoints: INTERNALCA
  Storage: nvram:COMPANYROOTCe#1D.cer

If you create a VPN connection or use the trustpoint otherwise, you can check the cached CRL on the router with following command:

Router#show crypto pki crls 
CRL Issuer Name: 
    cn=Root Certificate Authority,ou=IT,o=COMPANY,c=US
    LastUpdate: 08:41:50 CEST Apr 16 2020
    NextUpdate: 21:01:50 CEST Apr 19 2020

    CRL downloaded at: 09:00:48 CEST Apr 16 2020

    Retrieved from CRL Distribution Point: 
      http://ca.company.com/Root%20Certificate%20Authority.crl

 CRL DER is 1946 bytes
 CRL is stored in parsed CRL cache


Parsed CRL cache current size is 1946 bytes
Parsed CRL cache maximum size is 65536 bytes

As usually only the HTTP URLs is reachable from outside the network, there will be an error while establishing a VPN connection for example:

*Apr  9 09:20:27.100: %PKI-4-CRL_LDAP_QUERY: An attempt to retrieve the CRL from ldap:///CN=Root%20Certificate%20Authority,CN=SERVER02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=company,DC=local?certificateRevocationList?base?objectClass=cRLDistributionPoint using LDAP has failed

This error can be ignored, as the CRL via HTTP can be downloaded without issues and the VPN connection will be established. So i dont provide a direct solution, but i recommend that you integrate the CRL URL within the certificate itself.

If you create the cerfiticate on a Windows CA, the CRL field looks like following:

Answer 2

My somewhat educated guess is that Cisco has added options to that command in later releases, and since IOS 15.4(3)M is rather old (2014), I'd guess that the http:// option was added later.

My recommendation is therefore to update to the latest version of the next branch, until your command starts working again.