Operation Manual – PKI
H3C S3610&S5510 Series Ethernet Switches
Chapter 1 PKI Configuration
1-11
Follow these steps to retrieve a certificate manually:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Online
pki retrieval-certificate
{
ca
|
local
}
domain domain-name
Retrieve a
certificate
manually
Offline
pki import-certificate
{
ca
|
local
}
domain domain
-
name
{
der | p12 |
pem
}
[
filename filename
]
Required
Use either
command
Caution:
z
If a PKI domain has already a CA certificate, you cannot retrieve another CA
certificate for it. This is in order to avoid inconsistency between the certificate and
enrollment information due to related configuration changes. To retrieve a new CA
certificate, use the
pki delete-certificate
command to delete the existing CA
certificate and local certificate first.
z
The
pki retrieval-certificate
configuration will not be saved in the configuration file.
1.7 Configuring PKI Certificate Validation
A certificate needs to be validated before being used. Validating a certificate is to check
that the certificate is signed by the CA and that the certificate has neither expired nor
been revoked.
Before validating a certificate, you need to retrieve the CA certificate.
You can specify whether CRL checking is required in certificate validation. If you enable
CRL checking, CRLs will be used in validation of a certificate.
I. Configuring CRL-checking-enabled PKI certificate validation
Follow these steps to configure CRL-checking-enabled PKI certificate validation:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter PKI domain view
pki domain
domain-name
—
Specify the URL of the
CRL distribution point
crl url url-string
Optional
No CRL distribution point
URL is specified by
default.
