# Enabling CRL

{% hint style="danger" %}
You do **NOT** need to enable CRL for SCEPman. By default, SCEPman uses OCSP for revocation.
{% endhint %}

SCEPman primarily relies on OCSP to check a certificates' revocation status as OCSP allows for real time revocation, making it the ideal protocol for dynamic working environments. In contrast, CRL operates on scheduled updates, limiting its effectiveness in time-sensitive scenarios.

However, CRL continues to be useful for legacy systems and application or as a fallback when OCSP is not available.

{% hint style="warning" %}
The CRL will not contain certificates that have been auto-revoked, only certificates that have been explicitly revoked in the Certificate Master
{% endhint %}

## Guide

{% stepper %}
{% step %}

### Navigate to your Environment Variables

Azure > App Services > SCEPman App Service (not Certificate Master) > Settings > Environment Variables

<figure><img src="/files/nRaYyEBkUQL1MLeUyT7G" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Add Environment Variables&#x20;

Please note Linux App Service Plans use a double underscore (\_\_) instead of a colon (:). For example: AppConfig\_\_CRL\_\_RequestToken

<table><thead><tr><th width="247">Setting</th><th width="291">Description</th><th>Value</th></tr></thead><tbody><tr><td><a href="/pages/azLaw5q1suJZll8Tt6gO#appconfig-crl-requesttoken">AppConfig:CRL:RequestToken</a></td><td><p>Defines the URL of the CRL. The CRL is available in both DER and PEM</p><p><br><strong>DER</strong>: https://<em>yourscepman</em>.azurewebsites.net/crl/<strong>{RequestToken}</strong></p><p></p><p><strong>PEM:</strong> https://yourscepman.azurewebsites.net/crl/pem/<strong>{RequestToken}</strong><br><br>Example: https://<em>yourscepman</em>.azurewebsites.net/crl/12345678</p></td><td>24 character <em>string</em></td></tr><tr><td><a href="/pages/azLaw5q1suJZll8Tt6gO#appconfig-crl-source">AppConfig:CRL:Source</a></td><td>Connects the CRL to your Azure Storage account</td><td>Storage</td></tr><tr><td><a href="/pages/azLaw5q1suJZll8Tt6gO#appconfig-crl-addcdp">AppConfig:CRL:AddCdp</a></td><td>Adds a CRL Distribution Point to issued certificates</td><td>true</td></tr><tr><td><a href="/pages/azLaw5q1suJZll8Tt6gO#appconfig-crl-validitydays">AppConfig:CRL:ValidityDays</a></td><td>The numbers of days that an issued CRL is valid</td><td><em>Floating Point</em><br>Example <em>0.1</em> days = 2.4 hours</td></tr></tbody></table>

<figure><img src="/files/WDkDqEIzNRZhvwaprGVh" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Apply Environment Variables

Press Apply after Environment Variables have been added.&#x20;

<figure><img src="/files/ck9USZ7LxabTj7vKVPXC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/nSSD5RgeMIMmo7fNjWW6" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Restart SCEPman App Service

New Environment Variables are applied after the SCEPman App Service is restarted

<figure><img src="/files/PSljCOwJGWUivq99WL6m" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Test CRL

Navigate to your CRL using the previously set Request Token in the format of https\://*yourscepman*.azurewebsites.net/crl/**{RequestToken}**

<figure><img src="/files/1LFTPpB8KFS5Mp8CH6s6" alt=""><figcaption></figcaption></figure>

If setup correctly, your CRL will be downloaded:

<figure><img src="/files/tLGGjkZImv73GECgESi9" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Use CRL with Applications or Systems

Once enabled, ensure your applications or systems are configured to check the CRL during certificate validation to prevent the use of revoked certificates. Some systems allow CRL as a fallback option in the case OCSP is unavailable

Other systems **only** allow CRL for revocation such as CBA for Entra, please see our guide here:&#x20;

{% content-ref url="/pages/n9Tix1OmppMKK19BvAcT" %}
[Certificate-based Authentication for Entra ID](/scepman-deployment/deployment-guides/scenarios/certificate-based-authentication-for-entra-id.md)
{% endcontent-ref %}
{% endstep %}
{% endstepper %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.scepman.com/certificate-management/manage-certificates/enabling-crl.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.