139
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create a certificate attribute
group and enter its view.
pki certificate attribute-group
group-name
By default, no certificate attribute
group exists.
3.
(Optional.) Configure an
attribute rule for issuer name,
subject name, or alternative
subject name.
attribute
id
{
alt-subject-name
{
fqdn
|
ip
} | {
issuer-name
|
subject-name
} {
dn
|
fqdn
|
ip
} }
{
ctn
|
equ
|
nctn
|
nequ
}
attribute-value
By default, not attribute rule is
configured.
4.
Return to system view.
quit
N/A
5.
Create a certificate access
control policy and enter its
view.
pki certificate access-control-policy
policy-name
By default, no certificate access
control policy exists.
6.
Create a certificate access
control rule (or statement).
rule
[
id
] {
deny
|
permit
}
group-name
By default, no statement is
configured, and all certificates can
pass the verification.
You can create multiple statements
for a certificate access control
policy.
Displaying and maintaining PKI
Execute
display
commands in any view.
Task Command
Display the contents of a certificate.
display pki certificate
domain
domain-name
{
ca
|
local
|
peer
[
serial
serial-num
]
}
Display certificate request status.
display pki certificate request-status
[
domain
domain-name
]
Display locally stored CRLs.
display pki crl domain
domain-name
Display certificate attribute group
information.
display pki certificate attribute-group
[
group-name
]
Display certificate access control policy
information.
display pki certificate access-control-policy
[
policy-name
]
PKI configuration examples
You can use different software applications, such as Windows server, RSA Keon, and OpenCA, to act as
the CA server.
If you use Windows server or OpenCA, install the SCEP add-on for Windows server or enable SCEP for
OpenCA. In either case, when you configure a PKI domain, you must use the
certificate request from ra
command to specify the RA to accept certificate requests for PKI entity enrollment to an RA.