H3C SOHO IE4300, Справочник по командам

Страница: 2238 / 3296

49
Usage guidelines
You can specify a nonexistent key pair for a PKI domain.
A key pair can be obtained in any of the following ways:
•
Use the
public-key local create
command to generate a key pair.
•
An application, like IKE using digital signature authentication, triggers the device to generate a
key pair.
•
Use the pki import command to import a certificate containing a key pair.
A PKI domain can have key pairs using only one type of cryptographic algorithm (DSA, ECDSA, or
RSA).
If you configure an ECDSA key pair for a PKI domain multiple times, the most recent configuration
takes effect.
The specified elliptic curve takes effect only if you specify a nonexistent key pair. The device will
automatically create the key pair by using the specified name and curve before submitting a
certificate request. The curve parameter is ignored if the specified key pair already exists or is
already contained in an imported certificate.
If you do not specify an elliptic curve, the secp192r1 curve is used by default in non-FIPS mode and
the secp256r1 curve is used by default in FIPS mode.
Examples
# Specify 384-bit ECDSA key pair abc for certificate request.
<Sysname> system-view
[Sysname] pki domain aaa
[Sysname-pki-domain-aaa] public-key ecdsa name abc secp384r1
Related commands
pki import
public-key local create
public-key rsa
Use
public-key rsa
to specify an RSA key pair for certificate request.
Use
undo public-key
to restore the default.
Syntax
public-key rsa { { encryption name encryption-key-name [ length key-length ]
| signature name signature-key-name [ length key-length ] } * | general name
key-name [ length key-length ] }
undo public-key
Default
No key pair is specified for certificate request.
Views
PKI domain view
Predefined user roles
network-admin
Parameters
encryption : Specifies a key pair for encryption.