Juniper JUNOSE 11.0.X IP SERVICES Configuration Manual page 255

enrollment retry-limit
enrollment retry-period
enrollment url
ipsec ca authenticate
Use the no version to return the CRL setting to the default, optional.
See crl.
Use to set the time period during which the router continues to send a certificate
request to the CA. You can specify a time period in the range 0–480 minutes,
with 0 specifying an infinite time period.
Example
host1(config-ca-identity)#enrollment retry-limit 200
Use the no version to restore the default of 60 minutes.
See enrollment retry-limit.
Use to set the number of minutes that the router waits after receiving no response
before resending a certificate request to the CA. You can specify a wait period
in the range 0–60 minutes.
Example
host1(config-ca-identity)#enrollment retry-period 40
Use the no version to restore the default, 1 minute.
See enrollment retry-period.
Use to specify the URL of the SCEP server, in the format http://server_ipaddress.
You can then use the ipsec ca authentication command to retrieve CA certificates
from the SCEP server, and the ipsec ca enroll command to retrieve the router's
public key certificates from the server.
Example
host1(config-ca-identity)#enrollment url http://192.168.99.105/scepurl
Use the no version to delete the enrollment URL specification.
See enrollment url.
Use to retrieve the specified CA's certificate. If authentication is successful, the
fingerprint is sent, and an ikeEnrollment message is logged at severity info.
The CA must be previously declared by the ipsec ca identity command.
Example
host1(config)#ipsec ca authenticate trustedca1
host1(config)#INFO 10/18/2003 03:45:16 ikeEnrollment (): Received CA
certificate for ca:trustedca1
Configuring Digital Certificates Using the Online Method
Chapter 8: Configuring Digital Certificates
229