Requesting A Certificate From An Rsa Keon Ca Server - HP 5920 Series Configuration Manual

Requesting a certificate from an RSA Keon CA server

Network requirements
Configure the PKI entity (the device) to request a local certificate from the CA server.
Figure 73 Network diagram
Configuring the RSA Keon CA server
1. Create a CA server named myca:
In this example, you must configure these basic attributes on the CA server:
Nickname—Name of the trusted CA.
Subject DN—DN attributes of the CA, including the common name (CN), organization unit
(OU), organization (O), and country (C).
You can use the default values for the other attributes.
Configure extended attributes:
2.
Configure parameters in the Jurisdiction Configuration section on the management page of the CA
server:
Select the correct extension profiles.
Enable the SCEP autovetting function to enable the CA server to automatically approve
certificate requests without manual intervention.
Specify the IP address list for SCEP autovetting.
Configuring the device
1. Synchronize the system time of the device with the CA server, so that the device can correctly
request certificates or obtain CRLs. (Details not shown.)
2. Create an entity named aaa with the common name as Device.
<Device> system-view
[Device] pki entity aaa
[Device-pki-entity-aaa] common-name Device
[Device-pki-entity-aaa] quit
3. Configure a PKI domain:
# Create a PKI domain named torsa and enter its view.
[Device] pki domain torsa
# Specify the name of the trusted CA as myca.
[Device-pki-domain-torsa] ca identifier myca
# Configure the URL of the registration server in the form of http://host:port/Issuing Jurisdiction ID,
where Issuing Jurisdiction ID is a hexadecimal string generated on the CA server.
[Device-pki-domain-torsa] certificate request url
http://4.4.4.133:446/c95e970f632d27be5e8cbf80e971d9c4a9a93337
# Specify the CA for accepting certificate requests.
200