HPE FlexFabric 5940 SERIES, Руководство по настройке безопасности

Страница: 289 / 571

276
Exporting certificates
IMPORTANT:
To export all certificates in PKCS12 format, the PKI domain must have a minimum of one local
certificate. If the PKI domain does not have any local certificates, the certificates in the PKI domain
cannot be exported.
You can export the CA certificate and the local certificates in a PKI domain to certificate files. The
exported certificate files can then be imported back to the device or other PKI applications.
To export certificates:
Step Command Remarks
1. Enter system
view.
system-view N/A
2. Export certificates.
•
Export certificates in DER format:
pki export domain domain - name der { all
| ca | local } filename filename
•
Export certificates in PKCS12 format:
pki export domain domain - name p12 { all
| local } passphrase p12-key filename
filename
•
Export certificates in PEM format:
pki export domain domain - name pem
{ { all | local } [ { 3des-cbc | aes-128-cbc |
aes-192-cbc | aes-256-cbc | des-cbc }
pem-key ] | ca } [ filename filename ]
If you do not specify a file
name when you export a
certificate in PEM format, this
command displays the
certificate content on the
terminal.
When you export a local
certificate with RSA key pairs
to a file, the certificate file
name might be different from
the file name specified in the
command. The actual
certificate file name depends
on the purpose of the key pair
contained in the certificate. For
more information, see
Security
Command Reference .
Removing a certificate
You can remove the CA certificate, local certificate, or peer certificates in a PKI domain. After you
remove the CA certificate, the system automatically removes the local certificates, peer certificates,
and CRLs in the domain.
You can remove a local certificate and request a new one when the local certificate is about to expire
or the certificate's private key is compromised. To remove a local certificate and request a new
certificate, perform the following tasks:
1. Remove the local certificate.
2. Use the public-key local destroy command to destroy the existing local key pair.
3. Use the public-key local create command to generate a new key pair.
4. Request a new certificate.
To remove a certificate:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Remove a certificate.
pki delete-certificate domain domain - name { ca
| local | peer [ serial serial-num ] }
If you use the peer
keyword without
specifying a serial