H3C Technologies H3C SecBlade LB Cards - Manual (Page 142)

131
Configuring PKI in the CLI
PKI configuration task list
Task Remarks
Configuring an entity DN Required.
Configuring a PKI domain Required.
Submitting a PKI certificate request
Submitting a certificate request
in auto mode
Required.
Use either approach.
Submitting a certificate request
in manual mode
Retrieving a certificate manually Optional.
Verifying PKI certificates Optional.
Destroying the local RSA key pair Optional.
Deleting a certificate Optional.
Configuring an access control policy Optional.
Configuring an entity DN
A certificate is the binding of a public key and the identity information of an entity, where the identity
information is identified by an entity distinguished name (DN). A CA identifies a certificate applicant
uniquely by entity DN.
An entity DN is defined by these parameters:
• Common name of the entity.
• Country code of the entity, a standard 2-character code. For example, CN represents China and US
represents the United States.
• FQDN of the entity, a unique identifier of an entity on the network. It consists of a host name and
a domain name and can be resolved to an IP address. For example, www.whatever.com is an
FQDN, where www is a host name and whatever.com a domain name.
• IP address of the entity.
• Locality where the entity resides.
• Organization to which the entity belongs.
• Unit of the entity in the organization.
• State where the entity resides.
The configuration of an entity DN must comply with the CA certificate issue policy. You need to determine,
for example, which entity DN parameters are mandatory and which are optional. Otherwise, certificate
requests might be rejected.
To configure an entity DN: