A network administrator has deployed BYOD onboarding using the ISE internal CA to issue certificates to employee devices. After several months, a security team requirement mandates that ISE must validate the revocation status of endpoint certificates in real time during EAP-TLS authentication, rather than relying on periodically downloaded lists. Which mechanism should the administrator configure in the certificate authentication settings to meet this requirement with the ISE internal CA?