Hello DP community,
I'm interested if anyone else has a suggestion for my following problem.
We have multiple datapowers and some of them are on a different network that does not have internet access. They are however required to do a CRL check but the external CA's publish their CRLs on the internet. So how do I go about creating a central (LDAP) repo where I can store CRLs so every Datapower can access them?

At first I thought it is convenient that the Datapower can store retrieved CRLs in an LDAP so other DP's can access them in that LDAP. But scanning the documentation it only mentions CRL retrieval. And storage is in a cache on every DP itself. So that idea doesn't work like I thought it would.
We have an LDAP (IBM Secure Verify Directory) where every DP has access to. But how do I fill that LDAP with external CRL's so every DP can access them?

Or does anyone have another suggestion on how to tackle the issue of a DP that has no internet access but still can use/retrieve CRL's from the internet ?

Our DP version is 10.6.0.9

Kind regards,

  Edde (Serviceteam Access Management, DUO, Netherlands)

We solved this by using a proxy for Internet access. In the user agent we add proxy policy entries for each CRL, telling the DP to go through the proxy when it needs to fetch those CRLs.