Hi colleagues,
is there a way to manually reload CRL from remote server? The problem is that routeros reload certificates once per hour and if I find compromised certificates and do revoke (updating CRL on the server) then I need to wait up to one hour (in worst case) while RouterOS will became aware about revoked certificate.
CRL lists are learned from imported certificates:
[doka@ROS7t] > /certificate/crl/print
Flags: D - DYNAMIC
Columns: CERT, LAST-UPDATE, NUM, REVOKED, URL
CERT LAST-UPDATE NUM REVOKED URL
0 D xxx.xxxx.net.ua-fullchain.pem_0 may/31/2023 10:16:11 1 0 http://xxx.xxxx.net.ua/A1.crl
1 D xxx.xxxx.net.ua-fullchain.pem_1 may/31/2023 10:16:11 1 0 http://xxx.xxxx.net.ua/R1.crl
2 D xxx.xxxx.net.ua-fullchain.pem_2 may/31/2023 10:16:11 1 0 http://xxx.xxxx.net.ua/R1.crl
and
[doka@ROS7t] > /certificate/settings/print
crl-download: yes
crl-use: yes
crl-store: ram
How I can force reloading of CRL lists upon request?
And additional question - I couldn't find documentation on /certificate/settings section - can anyone point me where these commands are described?
Thank you.