H3C SOHO IE4300, Command Reference Manual

Page: 2241 / 3296

52
The device compares the fingerprint contained in the root CA certificate with the fingerprint
configured in the PKI domain, if either of the following conditions exists:
•
The CA certificate to be imported or obtained is a root certificate that does not exist on the
device.
•
The CA certificate to be imported or obtained is a certificate chain and contains a root certificate
that does not exist on the device.
If the two fingerprints do not match, the device rejects the CA certificate. If no fingerprint is configured
in the PKI domain, the device prompts you to manually verify the fingerprint of the root CA certificate.
Examples
# Specify an MD5 fingerprint for verifying the root CA certificate. (This feature is supported only in
non-FIPS mode.)
<Sysname> system-view
[Sysname] pki domain aaa
[Sysname-pki-domain-aaa] root-certificate fingerprint md5
12EF53FA355CD23E12EF53FA355CD23E
# Specify an SHA1 fingerprint for verifying the root CA certificate.
<Sysname> system-view
[Sysname] pki domain aaa
[Sysname-pki-domain-aaa] root-certificate fingerprint sha1
D1526110AAD7527FB093ED7FC037B0B3CDDDAD93
Related commands
certificate request mode
pki import
pki retrieve-certificate
rule
Use
rule
to create an access control rule.
Use
undo rule
to remove an access control rule.
Syntax
rule [ id ] { deny | permit } group-name
undo rule id
Default
No access control rules exist.
Views
Certificate-based access control policy view
Predefined user roles
network-admin
Parameters
id
: Assigns an ID to the access control rule, in the range of 1 to 16. The default setting is the
smallest unused ID in this range.
deny
: Denies the certificates that match the associated attribute group.
permit
: Permits the certificates that match the associated attribute group.