1-8
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter PKI domain view
pki domain
domain-name
—
Set the certificate request mode to
manual
certificate request mode manual
Optional
Manual by default
Return to system view
quit
—
Retrieve a CA certificate manually
Refer to
Retrieving a Certificate
Manually
Required
Generate a local RSA key pair
public-key local create
rsa
Required
No local RSA key pair exists by
default.
Submit a local certificate request
manually
pki request-certificate domain
domain-name
[
password
]
[
pkcs10
[
filename
filename
] ]
Required
z
If a PKI domain already has a local certificate, creating an RSA key pair will result in inconsistency
between the key pair and the certificate. To generate a new RSA key pair, delete the local
certificate and then issue the
public-key local create
command. For information about the
public-key local create
command, refer to
Public Key Commands
in the
Security Volume
.
z
A newly created key pair will overwrite the existing one. If you perform the
public-key local create
command in the presence of a local RSA key pair, the system will ask you whether you want to
overwrite the existing one.
z
If a PKI domain has already a local certificate, you cannot request another certificate for it. This is to
avoid inconsistency between the certificate and the registration information resulting from
configuration changes. To request a new certificate, use the
pki delete-certificate
command to
delete the existing local certificate and the CA certificate stored locally.
z
When it is impossible to request a certificate from the CA through SCEP, you can save the request
information by using the
pki request-certificate domain
command with the
pkcs10
and
filename
keywords, and then send the file to the CA by an out-of-band means.
z
Make sure the clocks of the entity and the CA are synchronous. Otherwise, the validity period of the
certificate will be abnormal.
z
The
pki request-certificate domain
configuration will not be saved in the configuration file.
Retrieving a Certificate Manually
You can download an existing CA certificate, local certificate, or peer entity certificate from the CA
server and save it locally. To do so, you can use two ways: online and offline. In offline mode, you need
to retrieve a certificate by an out-of-band means like FTP, disk, e-mail and then import it into the local
PKI system.
Certificate retrieval serves two purposes:
z
Locally store the certificates associated with the local security domain for improved query efficiency
and reduced query count,
