Displaying And Maintaining Pki - HP MSR Series Configuration Manual

scenario, the match process stops, and the system performs the access control action defined in the
access control rule.
The following conditions describe how a certificate-based access control policy verifies the validity of
a certificate:
•
If a certificate matches a permit statement, the certificate passes the verification.
•
If a certificate matches a deny statement or does not match any statements in the policy, the
certificate is regarded invalid.
•
If a statement is associated with a non-existing attribute group, or the attribute group does not
have attribute rules, the certificate matches the statement.
•
If the certificate-based access control policy referenced by a security application (for example,
HTTPS) does not exist, all certificates in the application pass the verification.
To configure a certificate-based access control policy:
Step
1. Enter system view.
2. Create a certificate attribute
group and enter its view.
3. (Optional.) Configure an
attribute rule for issuer name,
subject name, or alternative
subject name.
4. Return to system view.
5. Create a certificate-based
access control policy and
enter its view.
6. Create a certificate access
control rule.

Displaying and maintaining PKI

Execute display commands in any view.
Task
Display the contents of a certificate.
Display certificate request status.
Display locally stored CRLs in a PKI
domain.
Display certificate attribute group
information.
Display certificate-based access control
policy information.
Command
system-view
pki certificate attribute-group
group-name
attribute id { alt-subject-name
{ fqdn | ip } | { issuer-name |
subject-name } { dn | fqdn | ip } }
{ ctn | equ | nctn | nequ}
attribute-value
quit
pki certificate
access-control-policy
policy-name
rule [ id ] { deny | permit }
group-name
Command
display pki certificate domain domain-name { ca | local | peer
[ serial serial-num ] }
display pki certificate request-status [ domain domain-name ]
display pki crl domain domain-name
display pki certificate attribute-group [ group-name ]
display pki certificate access-control-policy [ policy-name ]
258
Remarks
N/A
By default, no certificate attribute
groups exist.
By default, not attribute rules are
configured.
N/A
By default, no certificate-based
access control policy exists.
By default, no certificate access
control rules are configured, and
all certificates can pass the
verification.
You can create multiple certificate
access control rules for a
certificate-based access control
policy.