Enabling the automatic online certificate request mode
About automatic online certificate request mode
In auto request mode, a PKI entity with no local certificates automatically submits a certificate request to the CA when an application works with the PKI entity. For example, when IKE negotiation uses a digital signature for identity authentication, but no local certificate is available, the entity automatically submits a certificate request. It saves the certificate locally after obtaining the certificate from the CA.
A CA certificate must be present before you request a local certificate. If no CA certificate exists in the PKI domain, the PKI entity automatically obtains a CA certificate before sending a certificate request.
Restrictions and guidelines
In auto request mode, the device does not automatically request a new certificate if the current certificate is about to expire or has expired, which might cause service interruptions.
Procedure
Enter system view.
system-view
Enter PKI domain view.
pki domain domain-name
Enable the automatic online certificate request mode.
certificate request mode auto [ password { cipher | simple } string ]
By default, the manual request mode applies.
If the CA policy requires a password for certificate revocation, specify the password in this command.