Configuring a PKI domain
Before requesting a PKI certificate, an entity needs to be configured with some enrollment information, which is referred to as a PKI domain. A PKI domain is intended only for convenience of reference by other applications like SSL, and has only local significance. The PKI domain configured on a device is invisible to the CA and other devices, and each PKI domain has its own parameters.
A PKI domain is defined by these parameters:
Trusted CA—An entity requests a certificate from a trusted CA.
Entity—A certificate applicant uses an entity to provide its identity information to a CA.
RA—Generally, an independent RA is in charge of certificate request management. It receives the registration request from an entity, examines its qualification, and determines whether to ask the CA to sign a digital certificate. The RA only examines the application qualification of an entity. It does not issue any certificate. Sometimes, the registration management function is provided by the CA, in which case no independent RA is required. Hewlett Packard Enterprise recommends you to deploy an independent RA.
URL of the registration server—An entity sends a certificate request to the registration server through SCEP, a dedicated protocol for an entity to communicate with a CA.
Polling interval and count—After an applicant makes a certificate request, the CA might need a long period of time if it verifies the certificate request manually. During this period, the applicant needs to query the status of the request periodically to get the certificate as soon as possible after the certificate is signed. You can configure the polling interval and count to query the request status.
IP address of the LDAP server—An LDAP server is usually deployed to store certificates and CRLs. If this is the case, you need to configure the IP address of the LDAP server.
Fingerprint for root certificate verification—After receiving the root certificate of the CA, an entity needs to verify the fingerprint of the root certificate. If the fingerprint of the root certificate does not match the one configured for the PKI domain, the entity rejects the root certificate, and the local certificate request fails.
To configure a PKI domain:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Create a PKI domain and enter its view. | pki domain domain-name | No PKI domain exists by default. You can configure up to 32 PKI domains on a device. |
3. Specify the trusted CA. | ca identifier name | No trusted CA is specified by default. The CA name is required only when you retrieve a CA certificate. It is not used for local certificate request. |
4. Specify the entity for certificate request. | certificate request entity entity-name | No entity is specified by default. The specified entity must exist. |
5. Specify the authority for certificate request. | certificate request from { ca | ra } | No authority is specified by default. |
6. Configure the URL of the server for certificate request. | certificate request url url-string | No URL is configured by default. The URL does not support domain name resolution. |
7. Configure the polling interval and attempt limit for querying the certificate request status. | certificate request polling { count count | interval minutes } | Optional. The polling is executed for up to 50 times at the interval of 20 minutes by default. |
8. Specify the LDAP server. | ldap-server ip ip-address [ port port-number ] [ version version-number ] | Optional. No LDP server is specified by default. |
9. Configure the fingerprint for root certificate verification. | root-certificate fingerprint { md5 | sha1 } string | Required when the certificate request mode is auto and optional when the certificate request mode is manual. In the latter case, if you do not configure this command, the fingerprint of the root certificate must be verified manually. No fingerprint is configured by default. |