HP 5500 HI Series Configuration Manual page 8

Configuring the HABP server ····························································································································· 232
Configuring an HABP client ······························································································································· 232
Displaying and maintaining HABP ····························································································································· 233
HABP configuration example ······································································································································ 233
Managing public keys ············································································································································ 236
Overview ······································································································································································· 236
FIPS compliance ··························································································································································· 236
Configuration task list ·················································································································································· 237
Creating a local asymmetric key pair ························································································································ 237
Displaying or exporting the local host public key ···································································································· 238
Destroying a local asymmetric key pair ···················································································································· 239
Specifying the peer public key on the local device ·································································································· 239
Displaying and maintaining public keys ··················································································································· 240
Public key configuration examples ····························································································································· 241
Manually specifying the peer public key on the local device ········································································ 241
Importing a peer public key from a public key file ·························································································· 243
Configuring PKI ······················································································································································· 246
Overview ······································································································································································· 246
PKI terms ······························································································································································· 246
PKI architecture ···················································································································································· 247
PKI operation ······················································································································································· 247
PKI applications ··················································································································································· 248
PKI configuration task list ············································································································································ 248
Configuring an entity DN ············································································································································ 249
Configuring a PKI domain ··········································································································································· 250
Configuration guidelines ···································································································································· 251
Configuration procedure ···································································································································· 251
Submitting a PKI certificate request ···························································································································· 251
Submitting a certificate request in auto mode ·································································································· 252
Submitting a certificate request in manual mode ····························································································· 252
Retrieving a certificate manually ································································································································ 253
Configuration guidelines ···································································································································· 253
Configuration procedure ···································································································································· 254
Configuring PKI certificate verification ······················································································································ 254
Configuration guidelines ···································································································································· 254
Configuring CRL-checking-enabled PKI certificate verification ······································································· 254
Configuring CRL-checking-disabled PKI certificate verification ······································································ 255
Destroying a local RSA key pair ································································································································ 255
Deleting a certificate ···················································································································································· 256
Configuring an access control policy ························································································································ 256
Displaying and maintaining PKI ································································································································· 256
PKI configuration examples ········································································································································· 257
Certificate request from an RSA Keon CA server ···························································································· 257
Certificate request from a Windows 2003 CA server ···················································································· 260
Certificate attribute access control policy configuration example ································································· 263
Troubleshooting PKI ····················································································································································· 265
Failed to retrieve a CA certificate ······················································································································ 265
Failed to request a local certificate ··················································································································· 265
Failed to retrieve CRLs ········································································································································ 266
Configuring IPsec ···················································································································································· 267
Overview ······································································································································································· 267
Basic concepts ····················································································································································· 267
IPsec for IPv6 routing protocols ·························································································································· 270
vi