226
To submit a certificate request in manual mode:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter PKI domain view.
pki domain
domain-name
—
3.
Set the certificate request
mode to
manual
.
certificate request mode manual
Optional
Manual by default
4.
Return to system view.
quit
—
5.
Retrieve a CA certificate
manually.
."
Required
6.
Generate a local RSA or DSA
key pair.
public-key local create
{
dsa
|
rsa
}
Required
7.
Submit a local certificate
request manually.
pki request-certificate domain
domain-
name
[
password
] [
pkcs10
[
filename
filename
] ]
Required
NOTE:
•
If a PKI domain already has a local certificate, creating an RSA key pair results in inconsistency
between the key pair and the certificate. To generate a new RSA key pair, delete the local certificate
and then issue the
public-key local create.
For more information
,
see
Security Command Reference.
•
A newly created key pair overwrites the existing one. If you perform
public-key local create
in the
presence of a local RSA or DSA key pair, the system asks whether you want to overwrite the existing
one.
•
If a PKI domain already has a local certificate, you cannot request another certificate for it. This helps
avoid inconsistency between the certificate and the registration information resulting from
configuration changes. Before requesting a new certificate, use
pki delete-certificate
to delete the
existing local certificate and the CA certificate stored locally.
•
When it is impossible to request a certificate from the CA through SCEP, print the request information
or save the request information to a local file, and then send the printed information or saved file to
the CA by an out-of-band means. To print the request information, use
pki request-certificate
domain
with the
pkcs10
keyword. To save the request information to a local file, use
pki request-
certificate domain
with the
pkcs10 filename
filename keyword and argument combination.
•
Make sure that the clocks of the entity and the CA are synchronous. Otherwise, the validity period of
the certificate is abnormal.
•
The
pki request-certificate domain
configuration is not saved in the configuration file.
Retrieving a certificate manually
download CA certificates, local certificates, or peer entity certificates from the CA server and save them
locally. To do so, use either the offline mode or the online mode. In offline mode, you must retrieve a
certificate by an out-of-band means like FTP, disk, or email and then import it into the local PKI system.
Certificate retrieval serves the following purposes:
•
Locally stores the certificates associated with the local security domain for improved query
efficiency and reduced query count
