H3C S3100 Series Command Manual page 1140

permit: Indicates that a certificate whose attributes match an attribute rule in the specified attribute
group is considered valid and permitted.
group-name: Name of the certificate attribute group to be associated with the rule.
all: Specifies all access control rules.
Description
Use the rule command to create a certificate attribute access control rule.
Use the undo rule command to delete a specified or all access control rules.
By default, no access control rule exists.
Note that a certificate attribute group must exist to be associated with a rule.
Examples
# Create an access control rule, specifying that a certificate is considered valid when it matches an
attribute rule in certificate attribute group mygroup.
<Sysname> system-view
[Sysname] pki certificate access-control-policy mypolicy
[Sysname-cert-acp-mypolicy] rule 1 permit mygroup
state
Syntax
state state-name
undo state
View
PKI entity view
Parameters
state-name: State or province name, a case-insensitive string of 1 to 31 characters. No comma can be
included.
Description
Use the state command to specify the name of the state or province where an entity resides.
Use the undo state command to remove the configuration.
By default, no state or province is specified.
Examples
# Specify the state where an entity resides.
<Sysname> system-view
[Sysname] pki entity 1
[Sysname-pki-entity-1] state country
1-23