227
•
Prepares for certificate verification
Before retrieving a local certificate in online mode, be sure to complete LDAP server configuration.
CAUTION:
•
If a PKI domain already has a CA certificate, you cannot retrieve another CA certificate for it. This
restriction helps avoid inconsistency between the certificate and registration information resulted from
configuration changes. To retrieve a new CA certificate, use
pki delete-certificate
to delete the
existing CA certificate and the local certificate first.
•
The
pki retrieval-certificate
configuration is not saved in the configuration file.
•
Be sure that the system time of the router falls in the validity period of the certificate so that the
certificate is valid.
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Retrieve a
certificate
manually.
Online
pki retrieval-certificate
{
ca
|
local
}
domain
domain-name
Required.
Use either command.
Offline
pki import-certificate
{
ca
|
local
}
domain
domain
-
name
{
der
|
p12
|
pem
}
[
filename
filename
]
Configuring PKI certificate verification
A certificate needs to be verified before being used. Verifying a certificate checks that the certificate is
signed by the CA and that the certificate has neither expired nor been revoked.
specify whether CRL checking is required in certificate verification. If you enable CRL checking, CRLs are
used in verification of a certificate. In this case, be sure to retrieve the CA certificate and CRLs to the
local router before the certificate verification. If you disable CRL checking, you only have to retrieve the
CA certificate.
Configuring CRL-checking-enabled PKI certificate verification
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter PKI domain view.
pki domain
domain-name
—
3.
Specify the URL of the CRL
distribution point.
crl url
url-string
Optional.
No CRL distribution point URL is
specified by default.
4.
Set the CRL update period.
crl update-period
hours
Optional.
By default, the CRL update period
depends on the next update field
in the CRL file.
5.
Enable CRL checking.
crl check
enable
Optional.
Enabled by default.
6.
Return to system view.
quit
—
