HP A-F1000-E Getting Started Manual page 70

Figure 44 Network diagram for configuring HTTPS login
Firewall
Configuration procedure
Configure the Firewall that acts as the HTTPS server
1.
# Configure a PKI entity, configure the common name of the entity as http-server1, and the FQDN of the
entity as ssl.security.com.
<Firewall system-view
[Firewall] pki entity en
[Firewall-pki-entity-en] common-name http-server1
[Firewall-pki-entity-en] fqdn ssl.security.com
[Firewall-pki-entity-en] quit
# Create a PKI domain, specify the trusted CA as new-ca, the URL of the server for certificate request as
http://10.1.2.2/certsrv/mscep/mscep.dll, authority for certificate request as RA, and the entity for
certificate request as en.
[Firewall] pki domain 1
[Firewall-pki-domain-1] ca identifier new-ca
[Firewall-pki-domain-1] certificate request url http://10.1.2.2/certsrv/mscep/mscep.dll
[Firewall-pki-domain-1] certificate request from ra
[Firewall-pki-domain-1] certificate request entity en
[Firewall-pki-domain-1] quit
# Create local RSA key pairs.
[Firewall] public-key local create rsa
# Retrieve the CA certificate from the certificate issuing server.
[Firewall] pki retrieval-certificate ca domain 1
# Request a local certificate from a CA through SCEP for the Firewall.
[Firewall] pki request-certificate domain 1
# Create an SSL server policy myssl, specify PKI domain 1 for the SSL server policy, and enable
certificate-based SSL client authentication.
[Firewall] ssl server-policy myssl
[Firewall-ssl-server-policy-myssl] pki-domain 1
[Firewall-ssl-server-policy-myssl] client-verify enable
[Firewall-ssl-server-policy-myssl] quit
# Create a certificate attribute group mygroup1, and configure a certificate attribute rule, specifying that
the Distinguished Name (DN) in the subject name includes the string of new-ca.
[Firewall] pki certificate attribute-group mygroup1
[Firewall-pki-cert-attribute-group-mygroup1] attribute 1 issuer-name dn ctn new-ca
64