275
Step Command
Remarks
and save it locally.
domain-name
the old one, if any.
The obtained CRL must be issued
by a CA certificate in the CA
certificate chain in the current
domain.
8.
Manually verify the validity
of the certificates.
pki validate-certificate
domain
domain-name
{
ca
|
local
}
N/A
Verifying certificates without CRL checking
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter PKI domain view.
pki domain
domain-name
N/A
3.
Disable CRL checking.
undo crl check enable
By default, CRL checking is
enabled.
4.
Return to system view.
quit
N/A
5.
Obtain the CA certificate.
."
N/A
6.
Manually verify the validity of
the certificates.
pki validate-certificate
domain
domain-name
{
ca
|
local
}
This command is not saved in the
configuration file.
Specifying the storage path for the certificates and
CRLs
CAUTION:
If you change the storage path, save the configuration before you reboot or shut down the device to
avoid loss of the certificates or the CRLs.
The device has a default storage path for certificates and CRLs. You can change the storage path
and specify different paths for the certificates and CRLs.
After you change the storage path for certificates or CRLs, the certificate files and CRL files in the
original path are moved to the new path. Certificate files use the .cer or .p12 file extension and CRL
files use the .crl file extension.
To specify the storage path for certificates and CRLs:
Task Command
Remarks
Specify the storage path for
certificates and CRLs.
pki storage
{
certificates
|
crls
}
dir-path
By default, the device stores certificates and
CRLs in the PKI directory on the storage
media of the device.
Содержание FlexFabric 5940 SERIES
Страница 251: ...238 ...
