Destroying A Local Rsa Key Pair - 3Com MSR 50 Series Configuration Manual

1838 C 97: PKI C
HAPTER
Destroying a Local
RSA Key Pair
ONFIGURATION
To do...
Enter system view
Enter PKI domain view
Specify the URL of the CRL
distribution point
Set the CRL update period crl update-period hours
Enable CRI checking
Return to system view
Retrieve the CA certificate Refer to
Retrieve CRLs
Verify the validity of the
certificate
Configuring CRL-checking-disabled PKI certificate validation
Follow these steps to configure CRL-checking-disabled PKI certificate validation:
To do...
Enter system view
Enter PKI domain view
Disable CRL checking
Return to system view
Retrieve the CA certificate
Verify the validity of the
certificate
n
The CRL update period refers to the interval at which the entity downloads
■
CRLs from the CRL access server. The CRL update period configured manually is
prior to that specified in the CRLs.
The pki retrieval-crl domain configuration will not be saved in the
■
configuration file.
A certificate has a lifetime which is determined by the CA. When the private key
leaks or the certificate is about to expire, you can destroy the old RSA key pair, and
then create a pair to request a new certificate.
Follow these steps to destroy a local RSA key pair:
Use the command...
system-view
pki domain domain-name
crl url url-string
crl check enable
quit
"Retrieving a
Certificate Manually" on page
1837
pki retrieval-crl domain
domain-name
pki validate-certificate { ca |
local } domain domain-name
Use the command...
system-view
pki domain domain-name
crl check disable
quit
Refer to "Retrieving a Certificate Manually"
on page 1837
pki validate-certificate { ca | local }
domain domain-name
Remarks
-
-
Optional
No CRL distribution point URL is
specified by default.
Optional
By default, the CRL update
period depends on the next
update field in the CRL file.
Optional
Enabled by default
-
Required
Required
Required
Remarks
-
-
Required
Enabled by
default
-
Required
Required