H3C Technologies H3C SecBlade LB Cards User Manual
Page 156
145
Certificate attribute-based access control policy configuration
1.
Network requirements
The client accesses the remote Hypertext Transfer Protocol Secure (HTTPS) server through the
HTTPS protocol.
Configure SSL to make sure only legal clients log into the HTTPS server. Create a certificate
attribute-based access control policy to control access to the HTTPS server.
Figure 69 Network diagram
2.
Configuration procedure
For more information about SSL configuration, see "Configuring SSL."
For more information about HTTPS configuration, see System Management Configuration Guide.
NOTE:
The PKI domain to be referenced by the SSL policy must be created in advance. For how to configure a PKI
domain, see "
a.
Configure the SSL policy on the HTTPS server.
[LB] ssl server-policy myssl
[LB-ssl-server-policy-myssl] pki-domain 1
[LB-ssl-server-policy-myssl] client-verify enable
[LB-ssl-server-policy-myssl] quit
b.
Configure the certificate attribute group.
# Create certificate attribute group mygroup1 and add two attribute rules. The first rule defines
that the DN of the subject name includes the string aabbcc, and the second rule defines that the
IP address of the certificate issuer is 10.0.0.1.
[LB] pki certificate attribute-group mygroup1
[LB-pki-cert-attribute-group-mygroup1] attribute 1 subject-name dn ctn aabbcc
[LB-pki-cert-attribute-group-mygroup1] attribute 2 issuer-name ip equ 10.0.0.1
[LB-pki-cert-attribute-group-mygroup1] quit
# Create certificate attribute group mygroup2 and add two attribute rules. The first rule defines
that the FQDN of the alternative subject name does not include the string of apple, and the
second rule defines that the DN of the certificate issuer name includes the string aabbcc.
[LB] pki certificate attribute-group mygroup2
[LB-pki-cert-attribute-group-mygroup2] attribute 1 alt-subject-name fqdn nctn
apple
[LB-pki-cert-attribute-group-mygroup2] attribute 2 issuer-name dn ctn aabbcc
[LB-pki-cert-attribute-group-mygroup2] quit
CA server
IP network
Host
LB
HTTPS client
HTTPS server