H3C SOHO IE4300, Command Reference Manual

Page: 2215 / 3296

26
Syntax
pki certificate attribute-group group-name
undo pki certificate attribute-group group-name
Default
No certificate attribute groups exist.
Views
System view
Predefined user roles
network-admin
Parameters
group-name
: Specifies a group name, a case-insensitive string of 1 to 31 characters.
Usage guidelines
A certificate attribute group is a set of attribute rules configured by using the
attribute
command.
Each attribute rule defines a matching criterion for an attribute in the issuer name, subject name, or
alternative subject name field of certificates.
A certificate attribute group must be associated with an access control rule (a permit or deny
statement configured by using the
rule command). If a certificate attribute group does not have any
attribute rules, the system determines that the all certificates match the associated access control
rule.
Examples
# Create a certificate attribute group named mygroup and enter its view.
<Sysname> system-view
[Sysname] pki certificate attribute-group mygroup
[Sysname-pki-cert-attribute-group-mygroup]
Related commands
attribute
display pki certificate attribute-group
rule
pki delete-certificate
Use pki delete-certificate to remove certificates from a PKI domain.
Syntax
pki delete-certificate domain domain - name { ca | local | peer [ serial
serial-num ] }
Views
System view
Predefined user roles
network-admin
Parameters
domain-name
: Specifies a PKI domain by its name, a case-insensitive string of 1 to 31 characters.
The domain name cannot contain the special characters listed in Table 10 .