Displaying And Maintaining Pki - HPE FlexNetwork 10500 Series Security Configuration Manual

attribute rules, each defining a matching criterion for an attribute in the certificate issuer name,
subject name, or alternative subject name field.
If a certificate matches all attribute rules in a certificate attribute group associated with an access
control rule, the system determines that the certificate matches the access control rule. In this
scenario, the match process stops, and the system performs the access control action defined in the
access control rule.
The following conditions describe how a certificate-based access control policy verifies the validity of
a certificate:
•
If a certificate matches a permit statement, the certificate passes the verification.
•
If a certificate matches a deny statement or does not match any statements in the policy, the
certificate is regarded invalid.
•
If a statement is associated with a non-existing attribute group, or the attribute group does not
have attribute rules, the certificate matches the statement.
•
If the certificate-based access control policy referenced by a security application (for example,
HTTPS) does not exist, all certificates in the application pass the verification.
To configure a certificate-based access control policy:
Step
1. Enter system view.
2. Create a certificate attribute
group and enter its view.
3. (Optional.) Configure an
attribute rule for issuer name,
subject name, or alternative
subject name.
4. Return to system view.
5. Create a certificate-based
access control policy and
enter its view.
6. Create a certificate access
control rule.

Displaying and maintaining PKI

Execute display commands in any view.
Task
Display the contents of a certificate.
Display certificate request status.
Display locally stored CRLs in a PKI
domain.
Command
system-view
pki certificate attribute-group
group-name
attribute id { alt-subject-name
{ fqdn | ip } | { issuer-name |
subject-name } { dn | fqdn | ip } }
{ ctn | equ | nctn | nequ}
attribute-value
quit
pki certificate
access-control-policy
policy-name
rule [ id ] { deny | permit }
group-name
Command
display pki certificate domain domain-name { ca | local | peer
[ serial serial-num ] }
display pki certificate request-status [ domain domain-name ]
display pki crl domain domain-name
305
Remarks
N/A
By default, no certificate attribute
groups exist.
By default, not attribute rules are
configured.
N/A
By default, no certificate-based
access control policies exist.
By default, no certificate access
control rules are configured, and
all certificates can pass the
verification.
You can create multiple certificate
access control rules for a
certificate-based access control
policy.