Configuring Pki Certificate Verification - 3Com 4510G Configuration Manual

If a PKI domain already has a CA certificate, you cannot retrieve another CA certificate for it. This
is in order to avoid inconsistency between the certificate and registration information due to
related configuration changes. To retrieve a new CA certificate, use the pki delete-certificate
command to delete the existing CA certificate and local certificate first.
The pki retrieval-certificate configuration will not be saved in the configuration file.

Configuring PKI Certificate Verification

A certificate needs to be verified before being used. Verifying a certificate is to check that the certificate
is signed by the CA and that the certificate has neither expired nor been revoked.
Before verifying a certificate, you need to retrieve the CA certificate.
You can specify whether CRL checking is required in certificate verification. If you enable CRL
checking, CRLs will be used in verification of a certificate.
Configuring CRL-checking-enabled PKI certificate verification
Follow these steps to configure CRL-checking-enabled PKI certificate verification:
To do...
Enter system view
Enter PKI domain view
Specify the URL of the CRL
distribution point
Set the CRL update period
Enable CRL checking
Return to system view
Retrieve the CA certificate
Retrieve CRLs
Verify the validity of a
certificate
Configuring CRL-checking-disabled PKI certificate verification
Follow these steps to configure CRL-checking-disabled PKI certificate verification:
Use the command...
system-view
pki domain domain-name
crl url url-string
crl update-period hours
crl check enable
quit
Refer to Retrieving a Certificate
Manually
pki retrieval-crl domain
domain-name
pki validate-certificate { ca |
local } domain domain-name
10-10
Remarks
—
—
Optional
No CRL distribution point URL
is specified by default.
Optional
By default, the CRL update
period depends on the next
update field in the CRL file.
Optional
Enabled by default
—
Required
Required
Required