Associating The Https Service With A Certificate Attribute Access Control Policy - H3C S5500-EI series Operation Manual

Operation Manual – SSL-HTTPS
H3C S5500-EI Series Ethernet Switches
Note:
After the HTTPS service is enabled, you can use the display ip https command to
view the state of the HTTPS service and verify the configuration.
Enabling of the HTTPS service will trigger an SSL handshake negotiation process.
During the process, if the local certificate of the device already exists, the SSL
negotiation is successfully performed, and the HTTPS service can be started
normally. If no local certificate exists, a certificate application process will be
triggered by the SSL negotiation. Since the application process takes much time,
the SSL negotiation may fail and the HTTPS service cannot be started normally.
Therefore, the ip https enable command must be executed for multiple times to
ensure normal startup of the HTTPS service.
2.5 Associating the HTTPS Service with a Certificate Attribute
Access Control Policy
Associating the HTTPS service with a configured certificate access control policy helps
control the access right of the client, thus providing the device with enhanced security.
Follow these steps to associate the HTTPS service with a certificate attribute access
control policy:
Enter system view
Associate the HTTPS service
with a certificate attribute
access control policy
Note:
If the ip https certificate access-control-policy command is executed repeatedly,
the HTTPS server is only associated with the last specified certificate attribute
access control policy.
If the HTTPS service is associated with a certificate attribute access control policy,
the client-verify enable command must be configured in the SSL server policy.
Otherwise, the client cannot log onto the device.
If the HTTPS service is associated with a certificate attribute access control policy,
the latter must contain at least one permit rule. Otherwise, no HTTPS client can log
onto the device.
For the configuration of an SSL server policy, refer to PKI Configuration.
To do... Use the command...
system-view
ip https certificate
access-control-policy
policy-name
2-3
Chapter 2 HTTPS Configuration
Remarks
—
Required
Not associated by
default.