Aborting A Certificate Request; Obtaining Certificates; Configuration Prerequisites - H3C S5830V2 Security Configuration Manual

Step
6. Submit a certificate
request or generate a
certificate request in
PKCS#10 format.

Aborting a certificate request

Before the CA issues a certificate, you can abort a certificate request to change some parameters, such
as the common name, country code, and FQDN, in the certificate request. You can use display pki
certificate request-status to display the certificate request status.
Alternatively, you can also remove the PKI domain to abort the certificate request.
To abort a certificate request:
Step
1. Enter system view.
2. Abort a certificate request.

Obtaining certificates

You can obtain the CA certificate, local certificates, and peer certificates related to a PKI domain from
a CA and save them locally for higher lookup efficiency. To do so, use either the offline mode or the
online mode:
In offline mode, obtain the certificates by an out-of-band means like FTP, disk, or email, and then
•
import them locally. This mode is suitable for the scenario where the CRL repository is not specified,
the CA server does not support SCEP, or the CA server generates the key pair for the certificates.
• In online mode, you can obtain the CA certificate through SCEP and obtain local certificates or
peer certificates through LDAP.

Configuration prerequisites

Before you obtain local or peer certificates in online mode, specify the LDAP server for the PKI domain.
Before you obtain local or peer certificates in offline mode, complete the following tasks:
Use FTP or TFTP to upload the certificate files to the storage media of the device. If FTP or TFTP is not
•
available, display and copy the certificate contents to a file. Make sure the certificate is in PEM
format because certificates only in PEM format can be imported by this means.
To import a local or peer certificate, a CA certificate chain must exist in the PKI domain, or be
•
carried in the local or peer certificate. If not, obtain it first.
Command
pki request-certificate domain
domain-name [ password password ]
[ pkcs10 [ filename filename ] ]
Command
system-view
pki abort-certificate-request
domain domain-name
134
Remarks
This command is not saved in the
configuration file.
Executing the command triggers
the PKI entity to automatically
generate a key pair according to
the key name, algorithm and
length defined in the PKI domain
if the key pair specified in the PKI
domain does not exist.
Remarks
N/A
This command is not saved in the
configuration file.