HPE FlexNetwork 10500 Series Security Configuration Manual page 487

Configuration procedure
1. Make sure the device, the host, and the CA server can reach each other. (Details not shown.)
2. Configure the HTTPS server on the device:
# Create a PKI entity named en. Set the common name and FQDN for the entity.
<Device> system-view
[Device] pki entity en
[Device-pki-entity-en] common-name http-server1
[Device-pki-entity-en] fqdn ssl.security.com
[Device-pki-entity-en] quit
# Create PKI domain 1 and specify CA server as the name of the trusted CA. Set the URL of
the registration server to http://10.1.2.2/certsrv/mscep/mscep.dll, the authority for certificate
request to RA, and the entity for certificate request to en. Set the URL of the CRL repository to
http://10.1.2.2/CertEnroll/caserver.crl.
[Device] pki domain 1
[Device-pki-domain-1] ca identifier CA server
[Device-pki-domain-1] certificate request url
http://10.1.2.2/certsrv/mscep/mscep.dll
[Device-pki-domain-1] certificate request from ra
[Device-pki-domain-1] certificate request entity en
[Device-pki-domain-1] crl url http://10.1.2.2/CertEnroll/caserver.crl
# Configure a general-purpose RSA key pair named abc and set the key modulus length to
1024 bits.
[Device-pki-domain-1] public-key rsa general name abc length 1024
[Device-pki-domain-1] quit
# Generate RSA key pair abc.
[Device] public-key local create rsa name abc
The range of public key size is (512 ~ 2048).
If the key modulus is greater than 512,it will take a few minutes.
Press CTRL+C to abort.
Input the modulus length [default = 1024]:
Generating Keys...
..........................++++++
.....................................++++++
Create the key pair successfully.
# Obtain the CA certificate.
[Device] pki retrieve-certificate domain 1 ca
The trusted CA's finger print is:
MD5
SHA1 fingerprint:DF6B C53A E645 5C81 D6FC 09B0 3459 DFD1 94F6 3DDE
Is the finger print correct?(Y/N):y
Retrieved the certificates successfully.
# Request a server certificate for the device.
[Device] pki request-certificate domain 1
Start to request general certificate ...
Certificate requested successfully.
# Create an SSL server policy named myssl.
[Device] ssl server-policy myssl
# Specify PKI domain 1 for the SSL server policy.
fingerprint:7682 5865 ACC2 7B16 6F52 D60F D998 4484
470