255
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create a certificate attribute
group and enter its view.
pki certificate attribute-group
group-name
By default, no certificate attribute
groups exist.
3.
(Optional.) Configure an
attribute rule for issuer
name, subject name, or
alternative subject name.
attribute
id
{
alt-subject-name
{
fqdn
|
ip
} | {
issuer-name
|
subject-name
} {
dn
|
fqdn
|
ip
} }
{
ctn
|
equ
|
nctn
|
nequ
}
attribute-value
By default, not attribute rules are
configured.
4.
Return to system view.
quit
N/A
5.
Create a certificate-based
access control policy and
enter its view.
pki certificate
access-control-policy
policy-name
By default, no certificate-based
access control policy exists.
6.
Create a certificate access
control rule.
rule
[
id
] {
deny
|
permit
}
group-name
By default, no certificate access
control rules are configured, and
all certificates can pass the
verification.
You can create multiple certificate
access control rules for a
certificate-based access control
policy.
Displaying and maintaining PKI
Execute
display
commands in any view.
Task Command
Display the contents of a certificate.
display pki certificate
domain
domain-name
{
ca
|
local
|
peer
[
serial
serial-num
]
}
Display certificate request status.
display pki certificate request-status
[
domain
domain-name
]
Display locally stored CRLs in a PKI
domain.
display pki crl domain
domain-name
Display certificate attribute group
information.
display pki certificate attribute-group
[
group-name
]
Display certificate-based access control
policy information.
display pki certificate access-control-policy
[
policy-name
]
PKI configuration examples
You can use different software applications, such as Windows server, RSA Keon, and OpenCA, to
act as the CA server.
If you use Windows server or OpenCA, you must install the SCEP add-on for Windows server or
enable SCEP for OpenCA. In either case, when you configure a PKI domain, you must use the
certificate request from ra
command to specify the RA to accept certificate requests.
If you use RSA Keon, the SCEP add-on is not required. When you configure a PKI domain, you must
use the
certificate request from ca
command to specify the CA to accept certificate requests.
Summary of Contents for 10500 series
Page 326: ...312 No duration limit for this SA ...