H3C SOHO IE4300, Command Reference Manual

Page: 2190 / 3296

1
PKI commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more
information about FIPS mode, see
Security Configuration Guide .
attribute
Use
attribute
to configure a rule to filter certificates based on an attribute in the certificate issuer
name, subject name, or alternative subject name field.
Use
undo attribute
to remove an attribute rule.
Syntax
attribute id { alt-subject-name { fqdn | ip } | { issuer-name | subject-name }
{ dn | fqdn | ip } } { ctn | equ | nctn | nequ } attribute-value
undo attribute id
Default
No attribute rules exist.
Views
Certificate attribute group view
Predefined user roles
network-admin
Parameters
id
: Specifies a rule ID in the range of 1 to 16.
alt-subject-name
: Specifies the alternative subject name field.
fqdn : Specifies the FQDN attribute.
ip : Specifies the IP address attribute.
dn
: Specifies the DN attribute.
issuer-name
: Specifies the issuer name field.
subject-name
: Specifies the subject name field.
ctn : Specifies the contain operation.
equ : Specifies the equal operation.
nctn
: Specifies the not-contain operation.
nequ
: Specifies the not-equal operation.
attribute-value
: Sets an attribute value, a case-insensitive string of 1 to 128 characters.
Usage guidelines
Different certificate fields support different attributes.
•
The subject name field and the issuer name field can contain a single DN, multiple FQDNs, and
multiple IP addresses.
•
The alternative subject name field can contain multiple FQDNs and IP addresses but zero DNs.