MDS 05-6628A01, Rev. B
MDS Orbit MCR-4G Technical Manual
71
When loading certificates manually, the file server from which the certificate will be retrieved must be
provided. The file server configuration can be entered every time or, to reduce typing, the file server
configuration can be selected from one of the preconfigured file servers (see “File Servers” section):
The following example shows loading of CA certificates using a file server defined prior to using the
Certificate Manager request:
admin@(none) 01:19:31> request pki get-cacert preconfigured-file-server { configuration_name
GE_file_server_1 } filename ms8-ca-cert cacert-identity ex_ca_cert_2
is-valid true
[ok][2012-06-19 01:20:03]
admin@(none) 01:20:03> show pki
KEY KEY
IDENTITY LENGTH KEY DATE TIME
----------------------------------------
ex_key 2048 2012-06-20T10:46:59Z
Here is an example of defining the file server manually in-line with the request call:
admin@(none) 00:35:27> request pki get-priv-key manual-file-server { tftp { address 192.168.1.2 } } file-
name der2048-priv-key key-identity ex_key_1
is-valid true
[ok][2012-06-19 00:36:27]
admin@(none) 00:36:27> show pki
KEY KEY
IDENTITY LENGTH KEY DATE TIME
----------------------------------------
ex_key 2048 2012-06-20T10:46:59Z
ex_key_1 2048 2012-06-19T04:36:26Z
When defining a file server manually you may, as in this example, accept the defaults provided (in this
example, block-size, port and timeout). After entering the address, a space and ‘}’ must be entered to
complete the parameters for the chosen mode. Always try the Tab-Enter to have the CLI show the
next needed parameters.
SCEP and CA Configuration
The process of interacting with a SCEP server involves getting the currently published certificate(s)
from the CA and then making a request for a client certificate with information and key material.
At a minimum, to get the published certificates from a CA, the SCEP server and the CA associated with
the SCEP server must be identified:
·
certmgr certificate-servers
·
certmgr ca-servers
The certificate server is defined in the certmgr under certificate-server. In the operation shown below,
we define the SCEP server.
