237
Use the
undo root-certificate fingerprint
command to remove the configuration.
By default, no fingerprint is configured for verifying the validity of the CA root certificate.
Examples
# Configure an MD5 fingerprint for verifying the validity of the CA root certificate.
<Sysname> system-view
[Sysname] pki domain 1
[Sysname-pki-domain-1] root-certificate fingerprint md5
12EF53FA355CD23E12EF53FA355CD23E
# Configure a SHA1 fingerprint for verifying the validity of the CA root certificate.
[Sysname-pki-domain-1] root-certificate fingerprint sha1
D1526110AAD7527FB093ED7FC037B0B3CDDDAD93
rule (PKI CERT ACP view)
Syntax
rule
[
id
] {
deny
|
permit
}
group-name
undo rule
{
id
|
all
}
View
PKI certificate access control policy view
Default level
2: System level
Parameters
id
: Specifies an ID for the certificate attribute access control rule, in the range 1 to 16. The default is the
smallest unused number in this range.
deny
: Indicates that a certificate whose attributes match an attribute rule in the specified attribute group
is considered invalid and denied.
permit
: Indicates that a certificate whose attributes match an attribute rule in the specified attribute group
is considered valid and permitted.
group-name
: Specifies a certificate attribute group by its name, a case-insensitive string of 1 to 16
characters. It cannot be
a
,
al
, or
all
.
all
: Specifies all access control rules.
Description
Use the
rule
command to create a certificate attribute access control rule.
Use the
undo rule
command to delete one or all access control rules.
By default, no access control rule exists.
A certificate attribute group must exist to be associated with a rule.
Examples
# Create an access control rule, specifying that a certificate is considered valid when it matches an
attribute rule in certificate attribute group mygroup.
<Sysname> system-view
[Sysname] pki certificate access-control-policy mypolicy
