Certificate Import And Export Configuration Example - HP MSR2000 Configuration Manual

[DeviceB-pki-domain-1] certificate request entity en
[DeviceB-pki-domain-1] ldap-server host 1.1.1.102
# Specify the RA to accept certificate requests.
[DeviceB-pki-domain-1] certificate request from ra
# Specify the RSA key pair with the purpose general, the name abc, and the length 1024 bits.
[DeviceB-pki-domain-1] public-key rsa general name abc length 1024
[DeviceB-pki-domain-1] quit
# Generate a local RSA key pair.
[DeviceB] public-key local create rsa name abc
The range of public key size is (512 ~ 2048).
If the key modulus is greater than 512,it will take a few minutes.
Press CTRL+C to abort.
Input the modulus length [default = 1024]:
Generating Keys...
..........................++++++
.....................................++++++
Create the key pair successfully.
# Obtain the CA certificate and save it locally.
[DeviceB] pki retrieve-certificate ca domain 1
# Submit a certificate request manually.
[DeviceB] pki request-certificate domain 1
# Create IKE proposal 1, and configure the authentication method as RSA digital signature.
[DeviceB] ike proposal 1
[DeviceB-ike-proposal-1] authentication-method rsa-signature
[DeviceB-ike-proposal-1] quit
# Reference the PKI domain used in IKE negotiation for the IKE profile peer.
[DeviceB] ike profile peer
[DeviceB-ike-profile-peer] certificate domain 1
The configurations are for IKE negotiation with RSA digital signature. For information about how to
configure IPsec SAs to be set up, see "Configuring IPsec."

Certificate import and export configuration example

Network requirements
Device B will replace Device A in the network. The PKI domain exportdomain on Device A has two local
certificates containing the private key and one CA certificate. To make sure the certificates are still valid
after Device B takes over Device A, copy the certificates on Device A to Device B and meet the following
requirements:
• Encrypt the private key in the local certificates using 3DES_CBC with the password 1 1 1 1 1 1 when you
export the local certificates from Device A.
Save the certificates on Device A in PEM format into the PKI domain importdomain on Device B.
•
125