Submitting a certificate request in manual mode

In manual mode, you must submit a local certificate request for an entity. Before the request, you must retrieve a CA certificate or generate a key pair for the PKI domain if the domain do not have the CA certificate or the key pair.

The CA certificate in the PKI domain is used to verify the authenticity and validity of a local certificate.

Generating a key pair is an important step in certificate request. The key pair includes a public key and a private key. The private key is kept by the user. The public key is transferred to the CA along with some other information. For more information about RSA key pair configuration, see "Managing public keys."

Configuration guidelines

Configuration procedure

To submit a certificate request in manual mode:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter PKI domain view.

pki domain domain-name

N/A

3. Set the certificate request mode to manual.

certificate request mode manual

Optional.

Manual by default.

4. Return to system view.

quit

N/A

5. Retrieve a CA certificate manually.

See "Retrieving a certificate manually"

N/A

6. Generate a local RSA key pair.

public-key local create rsa

No local RSA key pair exists by default.

7. Submit a local certificate request manually.

pki request-certificate domain domain-name [ password ] [ pkcs10 [ filename filename ] ]

N/A