On a Cisco 867 running IOS 15.6(3)M7, I'm trying to do the following:
TEST-GW1(config)#crypto pki trustpoint vpn-p2s-server-11 TEST-GW1(ca-trustpoint)#crl query http://myvpn/crls/21.crl % URL must begin with ldap://
I've found this post: https://community.cisco.com/t5/other-security-subjects/crl-request-via-ldap-on-c2611/td-p/214237 which seems to describe the same problem and suggests that there might be a flag or field I need to set differently in the trustpoint certificate, but I can't work out what it is I'd need to change there to allow an HTTP CRL endpoint for the trustpoint.
Additionally, I've found this: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_0100.pdf which at the top of page 5 shows an example using the same commands that I've used in my example above where an HTTP CRL endpoint works.
The trustpoint certificate that was imported includes an HTTP CRL endpoint already and as far as I can tell, no mention of LDAP.
What do I have to do to allow the HTTP CRL lookup to be used on that trustpoint?
The certificate I'm importing does have an HTTP CRL Distribution point in it already, but doesn't show up in the CRLs list:
HOST#show crypto pki certificates Certificate Status: Available Certificate Serial Number (hex): 00EA9801 Certificate Usage: General Purpose Issuer: cn=Test Intermediate CA o=MyVPN c=NZ Subject: Name: test.vpn.local cn=test.vpn.local o=MyVPN c=NZ CRL Distribution Points: http://myvpn/crls/21.crl Validity Date: start date: 13:22:25 NZST Apr 23 2020 end date: 13:22:25 NZST Apr 23 2023 Associated Trustpoints: vpn-p2s-server-11 Storage: nvram:myvpntest#8B45.cer HOST#show crypto pki crls HOST#