HP Pavilion a6600, Configuration Manual

Page: 240 / 501

228
To do… Command… Remarks
7.
Retrieve the CA certificate.
See " Retrieving a certificate
manually ."
Required.
8. Retrieve CRLs.
pki retrieval-crl domain domain-
name
Required.
9. Verify the validity of a
certificate.
pki validate-certificate { ca | local
} domain domain-name
Required.
NOTE:
•
The CRL update period defines the interval at which the entity downloads CRLs from the CRL server.
The CRL update period configured on the router is prior to that carried in the CRLs.
•
The pki retrieval-crl domain command cannot be saved in the configuration file.
•
The URL of the CRL distribution point does not support domain name resolution.
Configuring CRL-checking-disabled PKI certificate verification
To do… Command… Remarks
1. Enter system view.
system-view —
2. Enter PKI domain view.
pki domain domain-name —
3. Disable CRL checking.
crl check disable
Required
Enabled by default
4. Return to system view.
quit —
5. Retrieve the CA certificate.
See " Retrieving a certificate
manually ."
Required
6. Verify the validity of the
certificate.
pki validate-certificate { ca | local
} domain domain-name
Required
Destroying a local RSA or DSA key pair
A certificate has a lifetime, which is determined by the CA. When the private key leaks or the certificate
is about to expire, destroy the old RSA or DSA key pair and then create a pair to request a new
certificate.
To do… Command… Remarks
1. Enter system view.
system-view —
2. Destroy a local RSA or DSA
key pair.
public-key local destroy {
dsa | rsa }
Required
For more information, see
Security
Command Reference .