HP HP 830 Series, Руководство по настройке, Страница: 437 / 530

425
Configuration procedure for manual requests
Step Remarks
1. Creating a PKI entity
Required.
Create a PKI entity and configure the identity information.
A certificate is the binding of a public key and the identity information of an
entity, where the distinguished name (DN) shows the identity information of
the entity. A CA identifies a certificate applicant by a unique entity DN.
The DN settings of an entity need to be compliant with the CA certificate issue
policy, or the certificate request might be rejected. You must know the policy to
determine mandatory or optional entity parameters.
2. Creating a PKI domain
Required.
Create a PKI domain and set the certificate request mode to
Manual .
Before requesting a PKI certificate, an entity needs to be configured with
enrollment information, which is called a PKI domain.
A PKI domain is significant only to PKI and is intended as a reference for
other applications such as IKE and SSL.
3. Generating an RSA key
pair
Required.
Generate a local RSA key pair.
By default, no local RSA key pair exists.
Generating an RSA key pair is an important step in certificate request. The
key pair includes a public key and a private key. The private key is kept by
the user, and the public key is transferred to the CA.
IMPORTANT:
To maintain consistency between the key pair and the local certificate, you
must remove the certificate before generating a new key pair if a local
certificate already exists.
4. Retrieving the CA
certificate
Required.
Certificate retrieval serves the following purposes:
•
Locally store the certificates associated with the local security domain for
improved query efficiency and reduced query count,
•
Prepare for certificate verification.
IMPORTANT:
If a local CA certificate already exists, you cannot perform the CA certificate
retrieval operation. To avoid a possible mismatch between certificates and
registration information, you must remove the CA certificate and local
certificate first.