Pki Configuration Examples; Requesting A Certificate From A Ca Server Running Rsa Keon - HP A5830 Series Configuration Manual

To do...
Display information about
certificate attribute groups
Display information about
certificate attribute-based access
control policies

PKI configuration examples

When the CA uses Windows Server, the SCEP add-on is required, and you must use the certificate
request from ra command to specify that the entity request a certificate from an RA.
When the CA uses RSA Keon, the SCEP add-on is not required, and you must use the certificate request
from ca command to specify that the entity request a certificate from a CA.

Requesting a certificate from a CA server running RSA Keon

Network requirements
The switch submits a local certificate request to the CA server. See
•
The switch acquires the CRLs for certificate verification.
•
Figure 46 Request a certificate from a CA server running RSA Keon
Host
Configuration procedure
Configure the CA server.
1.
# Create a CA server named myca.
In this example, configure basic attributes including the Nickname and Subject DN on the CA server at
first. The Nickname indicates the name of the trusted CA. The Subject DN is the DN information of the
CA, including the Common Name (CN), Organization Unit (OU), Organization (O), and Country (C).
The other attributes might be left using the default values.
# Configure extended attributes.
After you configure the basic attributes, perform configuration on the jurisdiction configuration page of
the CA server. This includes selecting the proper extension profiles, enabling the SCEP autovetting
function, and adding the IP address list for SCEP autovetting.
# Configure the CRL distribution behavior.
After completing the configuration, you must perform CRL related configurations. In this example, select
the local CRL distribution mode of HTTP, and set the HTTP URL to http://4.4.4.133:447/myca.crl.
Use the command...
display pki certificate attribute-
group { group-name | all } [ | {
begin | exclude | include }
regular-expression ]
display pki certificate access-
control-policy { policy-name | all }
[ | { begin | exclude | include }
regular-expression ]
PKI entity
Internet
Device
Available in any view
Available in any view
CA server
158
Remarks
Figure 46.