Cisco ISE uses OCSP and CRL services to check the revocation status of client and server certificates against trusted Certificate Authorities (CA).

The ports required for Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL) services depend on the CA server or the service hosting OCSP or CRL. Cisco ISE services and ports documentation lists the basic ports used by the Cisco ISE administration node, monitoring node, and policy service node separately.

For OCSP, the default port is TCP 443. The Cisco ISE Admin portal accepts HTTP-based URLs for OCSP services. Non-default ports can also be used.

Cisco ISE uses HTTP 1.0 for OCSP communication and continues to operate with this protocol. Cisco ISE release 3.5 adds support for the Host header field specified in the HTTP 1.1 protocol when required by OCSP servers. This enhancement ensures compatibility with such servers while maintaining HTTP 1.0 as the underlying protocol. It does not provide full support for HTTP 1.1, and no additional configuration is needed to enable this feature.

For CRL, the default protocols are HTTP, HTTPS, and LDAP. The default ports are 443 (HTTPS) and 389 (LDAP), respectively. The actual port depends on the CRL server.