239
Configuring the RSA Keon CA server
1.
Create a CA server named
myca
:
In this example, you must configure these basic attributes on the CA server:
{
Nickname
—Name of the trusted CA.
{
Subject DN
—DN attributes of the CA, including the common name (CN), organization unit
(OU), organization (O), and country (C).
You can use the default values for other attributes.
2.
Configure extended attributes:
Configure parameters in the
Jurisdiction Configuration
section on the management page of
the CA server:
{
Select the correct extension profiles.
{
Enable the SCEP autovetting function to enable the CA server to automatically approve
certificate requests without manual intervention.
{
Specify the IP address list for SCEP autovetting.
Configuring the device
1.
Synchronize the system time of the device with the CA server for the device to correctly request
certificates or obtain CRLs. (Details not shown.)
2.
Create an entity named
aaa
and set the common name to
Device
.
<Device> system-view
[Device] pki entity aaa
[Device-pki-entity-aaa] common-name Device
[Device-pki-entity-aaa] quit
3.
Configure a PKI domain:
# Create a PKI domain named
torsa
and enter its view.
[Device] pki domain torsa
# Specify the name of the trusted CA as
myca
.
[Device-pki-domain-torsa] ca identifier myca
# Configure the URL of the CA server. The URL format is
http://host:port/Issuing Jurisdiction ID
,
where
Issuing Jurisdiction ID
is a hexadecimal string generated on the CA server.
[Device-pki-domain-torsa] certificate request url
http://1.1.2.22:446/80f6214aa8865301d07929ae481c7ceed99f95bd
# Specify the CA for accepting certificate requests.
[Device-pki-domain-torsa] certificate request from ca
# Specify the PKI entity name as
aaa
.
[Device-pki-domain-torsa] certificate request entity aaa
# Specify the URL of the CRL repository.
[Device-pki-domain-torsa] crl url ldap://1.1.2.22:389/CN=myca
# Specify the RSA key pair with the purpose
general
, the name
abc
, and the length 1024 bits.
[Device-pki-domain-torsa] public-key rsa general name abc length 1024
[Device-pki-domain-torsa] quit
4.
Generate a local RSA key pair.
[Device] public-key local create rsa name abc
The range of public key size is (512 ~ 2048).
If the key modulus is greater than 512,it will take a few minutes.
Press CTRL+C to abort.
Input the modulus length [default = 1024]:
Generating Keys...
