State; Rule (Access Control Policy View) - H3C MSR 20-20 Command Reference Manual

Example

rule (access control policy view)

Syntax
View
Parameter
Description
Example

state

Syntax
# Configure an MD5 fingerprint for validating the CA root certificate.
<Sysname> system-view
[Sysname] pki domain 1
[Sysname-pki-domain-1] root-certificate fingerprint md5 12EF53FA355C
D23E12EF53FA355CD23E
# Configure a SHA1 fingerprint for validating the CA root certificate.
[Sysname-pki-domain-1] root-certificate fingerprint sha1 D1526110AAD
7527FB093ED7FC037B0B3CDDDAD93
rule [ id ] { deny | permit } group-name
undo rule { id | all }
Access control policy view
id: Number of the certificate attribute-based access control rule, in the range 1 to
16. The default is the smallest unused number in this range.
deny: Indicates that a certificate matching an attribute rule in the specified
attribute group is considered invalid and denied.
permit: Indicates that a certificate matching an attribute rule in the specified
attribute group is considered valid and permitted.
group-name: Name of the certificate attribute group to be associated with the
rule, a case-insensitive string of 1 to 16 characters. It cannot be "a", "al" or "all".
all: Specifies all access control rules.
Use the command to create a certificate attribute access control rule.
rule
Use the command to delete a specified or all access control rules.
undo rule
By default, no access control rule exists.
Note that a certificate attribute group must exist to be associated with a rule.
# Create an access control rule, specifying that a certificate is considered valid it
matches an attribute rule in the certificate attribute group mygroup.
<Sysname> system-view
[Sysname] pki certificate access-control-policy mypolicy
[Sysname -pki-cert-acp-mypolicy] rule 1 permit mygroup
state state-name
2063