H3C S6812 Series Command Reference Manual page 1962

PKI commands
The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for
features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more
information about FIPS mode, see Security Configuration Guide.
attribute
Use attribute to configure a rule to filter certificates based on an attribute in the certificate issuer
name, subject name, or alternative subject name field.
Use undo attribute to remove an attribute rule.
Syntax
attribute id { alt-subject-name { fqdn | ip } | { issuer-name | subject-name } { dn | fqdn | ip } } { ctn
| equ | nctn | nequ } attribute-value
undo attribute id
Default
No attribute rules exist.
Views
Certificate attribute group view
Predefined user roles
network-admin
Parameters
id: Specifies a rule ID in the range of 1 to 16.
alt-subject-name: Specifies the alternative subject name field.
fqdn: Specifies the FQDN attribute.
ip: Specifies the IP address attribute.
dn: Specifies the DN attribute.
issuer-name: Specifies the issuer name field.
subject-name: Specifies the subject name field.
ctn: Specifies the contain operation.
equ: Specifies the equal operation.
nctn: Specifies the not-contain operation.
nequ: Specifies the not-equal operation.
attribute-value: Sets an attribute value, a case-insensitive string of 1 to 128 characters.
Usage guidelines
Different certificate fields support different attributes.
•
The subject name field and the issuer name field can contain a single DN, multiple FQDNs, and
multiple IP addresses.
•
The alternative subject name field can contain multiple FQDNs and IP addresses but zero DNs.
An attribute rule is a combination of an attribute-value pair with an operation keyword, as listed in
Table 1.
1