Configuration Procedure; Configuring Pki Certificate Verification; Configuration Guidelines; Configuring Crl-Checking-Enabled Pki Certificate Verification - H3C S5500-EI Series Security Configuration Manual

The configuration made by the pki retrieval-certificate configuration is not saved in the
•
configuration file.
Make sure the switch's system time falls in the validity period of the certificate so that the certificate
•
is valid.

Configuration procedure

To retrieve a certificate manually:
Step
1. Enter system view.
2. Retrieve a certificate
manually.

Configuring PKI certificate verification

A certificate needs to be verified before being used. Certificate verification can examine whether the
certificate is signed by the CA and whether the certificate has expired or been revoked.
You can specify whether to perform CRL checking during certificate verification. If you enable CRL
checking, CRLs will be used in verification of a certificate, and you must retrieve the CA certificate and
CRLs to the local switch before the certificate verification. If you disable CRL checking, you only need to
retrieve the CA certificate.

Configuration guidelines

The CRL update period defines the interval at which the entity downloads CRLs from the CRL server.
•
The CRL update period setting manually configured on the switch is prior to that carried in the CRLs.
• The configuration made by the pki retrieval-crl domain command is not saved in the configuration
file.

Configuring CRL-checking-enabled PKI certificate verification

Step
1. Enter system view.
2. Enter PKI domain view.
3. Specify the URL of the CRL
distribution point.
Command
system-view
•
In online mode:
pki retrieval-certificate { ca | local } domain
domain-name
•
In offline mode:
pki import-certificate { ca | local } domain
domain-name { der | p12 | pem } [ filename
filename ]
Command
system-view
pki domain domain-name
crl url url-string
267
Remarks
N/A
Use either command.
Remarks
N/A
N/A
Optional.
No CRL distribution point URL is
specified by default.