This KB will explain 

IKE negotiation fails due to CRL check failed as CA not reachable. Refer to syslog for more information

If the SRX don't have the CRL list downloaded due to CA server not reachable or CA server is not configured. 

If IKE is configured with certificate based authentication and if CRL revocation list is not present in the device, IKE negotiation fails due to "CRL check failed as CA not reachable. Refer to syslog for more information"

• Below is the command to verify the CRL list on the SRX -

> show security pki crl 
May 11 10:54:56
node0:
--------------------------------------------------------------------------

Follow below any method would resolve the issue -

• Configure CA server to download the CRL list  (via CRL or OCSP)

SRX1#set security pki ca-profile ca-profile-name revocation-check crl url http://CA-server.juniper.net/CRL/crllist.crl
SRX1#set security pki ca-profile ca-profile-name revocation-check crl disable on-download-failure                         <<- revocation-check will be disable if CA server is not reachable .     

or
SRX1#set security pki ca-profile ca-profile-name revocation-check ocsp url http://CA-server.juniper.net/root
SRX1#set security pki ca-profile ca-profile-name revocation-check use-ocsp

or

• Manually download the CRL list from server. Update the CRL list on the SRX in any folder and load to respective CA Profile 

SRX1>request security pki crl load ca-profile ca-profile-name filename /var/tmp/crl-list-filename.crl     (/var/tmp/crl-list-filename.crl-Location with filename)
SRX1>show security pki crl detail                                                                         <-- To see the CRL list.                                                                         

or

• Disable the CRL check for the CA profile.

SRX1#set security pki ca-profile <ca-profile-name> revocation-check disable

To understand Certificate Revocation Lists, refer to [SRX, J Series] Understanding PKI CRLs (Certificate Revocation List ) logs

2024-04-05 : Article Created
2024-05-08: Added OCSP method. 
2024-07-11: Added "crl disable on-download-failure" cmd