H3C Technologies H3C SecPath F1000-E - Manual (Page 780)

6
Table 2 Configuration task list for requesting a certificate automatically
Task Remarks
Creating a PKI Entity
Required
Create a PKI entity and configure the identity information.
A certificate is the binding of a public key and the identity information of an entity,
where the identity information is identified by an entity distinguished name (DN). A CA
identifies a certificate applicant uniquely by entity DN.
The identity settings of an entity must be compliant to the CA certificate issue policy.
Otherwise, the certificate request may be rejected.
Creating a PKI
Domain
Required
Create a PKI domain, setting the certificate request mode to Auto.
Before requesting a PKI certificate, an entity needs to be configured with some
enrollment information, which is referred to as a PKI domain.
A PKI domain is intended only for convenience of reference by other applications like
IKE and SSL, and has only local significance.
Destroying the RSA
Key Pair
Optional
Destroy the existing RSA key pair and the corresponding local certificate.
If the certificate to be retrieved contains an RSA key pair, you need to destroy the
existing RSA key pair. Otherwise, the retrieving operation will fail.
Retrieving and
Displaying a
Certificate
Optional
Retrieve an existing certificate and display its information.
IMPORTANT:
z Before retrieving a local certificate in online mode, be sure to complete LDAP
server configuration.
z If a PKI domain already has a CA certificate, you cannot retrieve another CA
certificate for it. This is in order to avoid inconsistency between the certificate and
registration information due to related configuration changes. To retrieve a new
CA certificate, use the pki delete-certificate command to delete the existing CA
certificate and local certificate first.
Retrieving and
Displaying a CRL Optional
Retrieve a CRL and display its contents.
Creating a PKI Entity
Select VPN > PKI > Entity from the navigation tree to display existing PKI entities, as shown in Figure
2 . Then, click Add to enter the PKI entity configuration page, as shown in Figure 3 .
Figure 2 PKI entity list