434
Usage guidelines
You can specify a nonexistent key pair in this command. You can get a key pair in any of the following
ways:
•
Use the
public-key local create
command to generate a key pair.
•
An application triggers the device to generate a key pair.
•
Use the
pki import
command to import a certificate containing a key pair.
A PKI domain can have key pairs using only one type of cryptographic algorithm (DSA, ECDSA, or
RSA).
A PKI domain can have two RSA key pairs of different purposes: one is the signing key pair, and the
other is the encryption key pair. If you configure an RSA signing key pair or RSA encryption key pair
multiple times, the most recent configuration takes effect. The RSA signing key pair and encryption
key pair do not overwrite each other.
If you specify a signing key pair and an encryption key pair separately, their key length can be
different.
The
length key-length
option takes effect only if you specify a nonexistent key pair. The device will
automatically create the key pair by using the specified name and length before submitting a
certificate request. The
length key-length
option is ignored if the specified key pair already exists or
is already contained in an imported certificate.
Examples
# Specify 2048-bit general purpose RSA key pair
abc
for certificate request.
<Sysname> system-view
[Sysname] pki domain aaa
[Sysname-pki-domain-aaa] public-key rsa general name abc length 2048
# Specify the following RSA key pairs for certificate request:
•
2048-bit RSA encryption key pair
rsa1
.
•
2048-bit RSA signing key pair
sig1
.
<Sysname> system-view
[Sysname] pki domain aaa
[Sysname-pki-domain-aaa] public-key rsa encryption name rsa1 length 2048
[Sysname-pki-domain-aaa] public-key rsa signature name sig1 length 2048
Related commands
pki import
public-key local create
root-certificate fingerprint
Use
root-certificate fingerprint
to set the fingerprint for verifying the root CA certificate.
Use
undo root-certificate fingerprint
to restore the default.
Syntax
In non-FIPS mode:
root-certificate fingerprint
{
md5
|
sha1
}
string
undo root-certificate fingerprint
In FIPS mode:
root-certificate fingerprint sha1 string
