HP VSR1000 Security Configuration Manual page 164

Figure 46 Network diagram
Configuring the CA server
The configuration is not shown. For information about how to configure an OpenCA server, see related
manuals.
When you configure the CA server, use the OpenCA version later than version 0.9.2 because the earlier
versions do not support SCEP.
Configuring the device
1. Synchronize the system time of the device with the CA server, so that the device can correctly
request a certificate.
2. Create an entity named aaa with the common name as rnd, the country code as CN, the
organization name as test, and the unit name as software.
<Device> system-view
[Device] pki entity aaa
[Device-pki-entity-aaa] common-name rnd
[Device-pki-entity-aaa] country CN
[Device-pki-entity-aaa] organization test
[Device-pki-entity-aaa] organization-unit software
[Device-pki-entity-aaa] quit
3. Configure a PKI domain:
# Create a PKI domain named openca and enter its view.
[Device] pki domain openca
# Specify the name of the trusted CA as myca.
[Device-pki-domain-openca] ca identifier myca
# Configure the URL of the registration server in the form of http://host/cgi-bin/pki/scep, where
host is the host IP address of the OpenCA server.
[Device-pki-domain-openca] certificate request url
http://192.168.222.218/cgi-bin/pki/scep
# Specify the RA to accept certificate requests.
[Device-pki-domain-openca] certificate request from ra
# Specify the PKI entity name as aaa.
[Device-pki-domain-openca] certificate request entity aaa
# Specify the RSA key pair with the purpose general, the name abc, and the length 1024 bits.
[Device-pki-domain-openca] public-key rsa general name abc length 1024
[Device-pki-domain-openca] quit
4. Generate a local RSA key pair.
[Device] public-key local create rsa name abc
The range of public key size is (512 ~ 2048).
If the key modulus is greater than 512,it will take a few minutes.
Press CTRL+C to abort.
154