Configuration Procedure; Configuring Pki Certificate Verification; Configuration Guidelines; Configuring Crl-Checking-Enabled Pki Certificate Verification - HP 5500 HI Series Configuration Manual

Security
Hide thumbs Also See for 5500 HI Series:
Table of Contents

Advertisement

The configuration made by the pki retrieval-certificate configuration is not saved in the
configuration file.
Make sure the switch's system time falls in the validity period of the certificate so that the certificate
is valid.

Configuration procedure

To retrieve a certificate manually:
Step
1.
Enter system view.
2.
Retrieve a certificate
manually.

Configuring PKI certificate verification

A certificate needs to be verified before being used. Certificate verification can examine whether the
certificate is signed by the CA and whether the certificate has expired or been revoked.
You can specify whether to perform CRL checking during certificate verification. If you enable CRL
checking, CRLs will be used in verification of a certificate, and you must retrieve the CA certificate and
CRLs to the local switch before the certificate verification. If you disable CRL checking, you only need to
retrieve the CA certificate.

Configuration guidelines

The CRL update period defines the interval at which the entity downloads CRLs from the CRL server.
The CRL update period setting manually configured on the switch is prior to that carried in the CRLs.
The configuration made by the pki retrieval-crl domain command is not saved in the configuration
file.

Configuring CRL-checking-enabled PKI certificate verification

Step
1.
Enter system view.
2.
Enter PKI domain view.
3.
Specify the URL of the CRL
distribution point.
Command
system-view
In online mode:
pki retrieval-certificate { ca | local } domain
domain-name
In offline mode:
pki import-certificate { ca | local } domain
domain-name { der | p12 | pem } [ filename
filename ]
Command
system-view
pki domain domain-name
crl url url-string
254
Remarks
N/A
Use either command.
Remarks
N/A
N/A
Optional.
No CRL distribution point URL is
specified by default.

Hide quick links:

Advertisement

Table of Contents
loading

Table of Contents