Clear Pass certification

[Syazusyazu923]

By using ClearPass, certificate is distributed to clients so that the client can access the network (EAP TLS). Clients can access the network by using distributed certificate. Once a client accessed the network, is there any way to deny that client  from accessing the network by making the distributed certificate invalid? Thanks in advance.

[airsecxd · Accepted solution]

Hi Syazusyazu923,

of cause there is a way. Key words are CRL or OCSP.

Greetings

[Syazusyazu923]

Thanks!

I will check the information about OCSD in ClearPass!

---

@airsecxd wrote:

Hi Syazusyazu923,

of cause there is a way. Key words are CRL or OCSP.

Greetings

---

[Syazusyazu923]

Hi. I already configured authentication method to use the tls with ocsp enabled. In the ocsp settings, I inserted the ocsp URL, and successfully revoked the certificate. Unfortunately, I was unable to unrevoked the certificate so that the client can access the network again. Please give me some suggestion or hint. Thanks in advance!

[msabin]

As I understand certificate rules, revoke is one-way. To "unrevoke" you re-issue a new certificate.

[airsecxd]

As msabin stated, you can not "unrevoke".
Your client needs to request and receive a new certificate from the PKI.

[Syazusyazu923]

Thank you very much! 

[Syazusyazu923]

Again, thanks a lot! Finally got the answer for my question!