beautypg.com

Requesting a certificate automatically – H3C Technologies H3C SecPath F1000-E User Manual

Page 779

background image

5

Task Remarks

Retrieving the CA
certificate

Required
Obtain the CA certificate and save it locally. For more information, see

Retrieving and

Displaying a Certificate

.

Certificate retrieval serves two purposes:

Locally store the certificates associated with the local security domain for improved
query efficiency and reduced query count,

Prepare for certificate verification.

IMPORTANT:

If there are already CA certificates locally, you cannot perform the CA certificate
retrieval operation. This is to avoid possible mismatch between certificates and
registration information resulting from relevant changes. To retrieve the CA
certificate, you need to remove the CA certificate and local certificate first.

Requesting a Local
Certificate

Required
When requesting a certificate, an entity introduces itself to the CA by providing its
identity information and public key, which will be the major components of the

certificate.
A certificate request can be submitted to a CA in two ways: online and offline.

In online mode, if the request is granted, the local certificate will be retrieved to the
local system automatically.

In offline mode, you need to retrieve the local certificate by an out-of-band means.

IMPORTANT:

If there is already a local certificate, you cannot perform the local certificate retrieval
operation. This is to avoid possible mismatch between the local certificate and
registration information resulting from relevant changes. To retrieve a new local
certificate, you need to remove the CA certificate and local certificate first.

Destroying the RSA
Key Pair

Optional
Destroy the existing RSA key pair and the corresponding local certificate.
If the certificate to be retrieved contains an RSA key pair, you need to destroy the
existing RSA key pair. Otherwise, the retrieving operation will fail.

Retrieving and
Displaying a
Certificate

Optional
Retrieve an existing certificate and display its information.

IMPORTANT:

Before retrieving a local certificate in online mode, be sure to complete LDAP server
configuration.

Retrieving and
Displaying a CRL

Optional
Retrieve a CRL and display its contents.

Requesting a Certificate Automatically

Perform the tasks in

Table 2

to configure the PKI system to request a certificate automatically.

This manual is related to the following products: