135
•
To import a local certificate containing an encrypted key pair, you must provide the challenge
password. Contact the CA server administrator, if necessary.
Configuration guidelines
•
If a CA certificate already exists locally, you cannot obtain it again in online mode. To obtain a new
one, use
pki delete-certificate
to remove the CA certificate and local certificates, and then obtain
the CA certificate.
•
If a PKI domain already has local or peer certificates, you can still perform the obtain operation,
and the obtained local or peer certificates overwrite the existing ones. If RSA is used, a PKI domain
can have two local certificates, one for signature and the other for encryption.
•
If CRL checking is enabled, CRL checking is triggered when you obtain a certificate. If the certificate
to be obtained has been revoked, the certificate cannot be obtained.
•
The device compares the validity period of a certificate with the local system time to determine
whether the certificate is valid. Make sure the system time of the device is synchronized with the CA
server.
Configuration procedure
To obtain certificates:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Import or obtain certificates.
•
Import certificates in offline mode:
pki import domain
domain-name
{
der
{
ca
|
local
|
peer
}
filename
filename
|
p12 local
filename
filename
|
pem
{
ca
|
local
|
peer
}
[
filename
filename
] }
•
Obtain certificates in online mode:
pki retrieve-certificate
domain
domain-name
{
ca
|
local
|
peer
entity-name
}
The
pki
retrieve-certificate
command is not saved
in the configuration
file.
Verifying PKI certificates
Every time a certificate is requested or obtained, or used by an application, it is automatically verified.
If the certificate expires, is not issued by a trusted CA, or is revoked, the certificate is not used.
You can also manually verify a certificate. If it is revoked, the certificate cannot be requested or obtained.
Verifying certificates with CRL checking
CRL checking checks whether a certificate is in the CRL. If yes, the certificate has been revoked and its
home entity is not trusted.
To use CRL checking, a CRL must be obtained from a CRL repository. The device selects a CRL repository
in the following order: CRL repository specified in the PKI domain, the CRL repository in the local
certificates, the CRL repository in the CA certificate, and the CRL obtained through SCEP.