237
4.
Request a new certificate.
To remove a certificate:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Remove a certificate.
pki delete-certificate
domain domain
-
name
{
ca
|
local
|
peer
[
serial
serial-num
] }
If you use the
peer
keyword without
specifying a serial
number, the command
removes all peer
certificates.
Configuring a certificate-based access control
policy
Certificate-based access control policies allow you to authorize access to a device (for example, an
HTTPS server) based on the attributes of an authenticated client's certificate.
A certificate-based access control policy is a set of access control rules (permit or deny statements),
each associated with a certificate attribute group. A certificate attribute group contains multiple
attribute rules, each defining a matching criterion for an attribute in the certificate issuer name,
subject name, or alternative subject name field.
If a certificate matches all attribute rules in a certificate attribute group associated with an access
control rule, the system determines that the certificate matches the access control rule. In this
scenario, the match process stops, and the system performs the access control action defined in the
access control rule.
The following conditions describe how a certificate-based access control policy verifies the validity of
a certificate:
•
If a certificate matches a permit statement, the certificate passes the verification.
•
If a certificate matches a deny statement or does not match any statements in the policy, the
certificate is regarded invalid.
•
If a statement is associated with a non-existing attribute group, or the attribute group does not
have attribute rules, the certificate matches the statement.
•
If the certificate-based access control policy referenced by a security application (for example,
HTTPS) does not exist, all certificates in the application pass the verification.
To configure a certificate-based access control policy:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create a certificate attribute
group and enter its view.
pki certificate attribute-group
group-name
By default, no certificate attribute
groups exist.
3.
(Optional.) Configure an
attribute rule for issuer name,
subject name, or alternative
subject name.
attribute
id
{
alt-subject-name
{
fqdn
|
ip
} | {
issuer-name
|
subject-name
} {
dn
|
fqdn
|
ip
} }
{
ctn
|
equ
|
nctn
|
nequ
}
attribute-value
By default, not attribute rules are
configured.
4.
Return to system view.
quit
N/A
5.
Create a certificate-based
access control policy and
pki certificate
access-control-policy
By default, no certificate-based
