28
# Create certificate attribute-based access control policy
myacp
and configure a certificate
attribute-based access control rule, specifying that a certificate is considered valid when it matches
an attribute rule in certificate attribute group
myacp
.
[AP] pki certificate access-control-policy myacp
[AP-pki-cert-acp-myacp] rule 1 permit mygroup1
[AP-pki-cert-acp-myacp] quit
# Associate the HTTPS service with SSL server policy
myssl
.
[AP] ip https ssl-server-policy myssl
# Associate the HTTPS service with certificate attribute-based access control policy
myacp
.
[AP] ip https certificate access-control-policy myacp
# Enable the HTTPS service.
[AP] ip https enable
# Create a local user named
usera
, set the password to
123
, and specify the Web service type.
[AP] local-user usera
[AP-luser-usera] password simple 123
[AP-luser-usera] service-type web
2.
Configure the host (HTTPS client):
On the host, run the IE browser, and then enter
http://10.1.2.2/certsrv
in the address bar and
request a certificate for the host as prompted.
3.
Verify the configuration:
On the host, enter
https://10.1.1.1
in the browser's address bar and then select the certificate
issued by
new-ca
. When the Web login page of the AP appears, enter the username
usera
and
password
123
to log in to the Web interface.
For more information about PKI configuration commands, SSL configuration commands, and the
public-key local create rsa
command, see
Security Command Reference.