134
Step Command
Remarks
6.
Submit a certificate
request or generate a
certificate request in
PKCS#10 format.
pki request-certificate domain
domain-name
[
password
password
]
[
pkcs10
[
filename
filename
] ]
This command is not saved in the
configuration file.
Executing the command triggers
the PKI entity to automatically
generate a key pair according to
the key name, algorithm and
length defined in the PKI domain
if the key pair specified in the PKI
domain does not exist.
Aborting a certificate request
Before the CA issues a certificate, you can abort a certificate request to change some parameters, such
as the common name, country code, and FQDN, in the certificate request. You can use
display pki
certificate request-status
to display the certificate request status.
Alternatively, you can also remove the PKI domain to abort the certificate request.
To abort a certificate request:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Abort a certificate request.
pki abort-certificate-request
domain
domain-name
This command is not saved in the
configuration file.
Obtaining certificates
You can obtain the CA certificate, local certificates, and peer certificates related to a PKI domain from
a CA and save them locally for higher lookup efficiency. To do so, use either the offline mode or the
online mode:
•
In offline mode, obtain the certificates by an out-of-band means like FTP, disk, or email, and then
import them locally. This mode is suitable for the scenario where the CRL repository is not specified,
the CA server does not support SCEP, or the CA server generates the key pair for the certificates.
•
In online mode, you can obtain the CA certificate through SCEP and obtain local certificates or
peer certificates through LDAP.
Configuration prerequisites
Before you obtain local or peer certificates in online mode, specify the LDAP server for the PKI domain.
Before you obtain local or peer certificates in offline mode, complete the following tasks:
•
Use FTP or TFTP to upload the certificate files to the storage media of the device. If FTP or TFTP is not
available, display and copy the certificate contents to a file. Make sure the certificate is in PEM
format because certificates only in PEM format can be imported by this means.
•
To import a local or peer certificate, a CA certificate chain must exist in the PKI domain, or be
carried in the local or peer certificate. If not, obtain it first.