HP 6125G HP 6125G & 6125G/XG Blade Switches Security Configuration Gui - Page 175

Configuring CRL-checking-disabled PKI certificate verification, Destroying a local RSA key pair

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 175 highlights

Step 4. Set the CRL update period. 5. Enable CRL checking. 6. Return to system view. 7. Retrieve the CA certificate. 8. Retrieve CRLs. 9. Verify the validity of a certificate. Command Remarks crl update-period hours Optional. By default, the CRL update period depends on the next update field in the CRL file. crl check enable Optional. Enabled by default. quit N/A See "Retrieving a certificate manually" N/A pki retrieval-crl domain domain-name N/A pki validate-certificate { ca | local } domain domain-name N/A Configuring CRL-checking-disabled PKI certificate verification To configure CRL-checking-disabled PKI certificate verification: Step 1. Enter system view. 2. Enter PKI domain view. Command system-view pki domain domain-name Remarks N/A N/A 3. Disable CRL checking. crl check disable Enabled by default 4. Return to system view. 5. Retrieve the CA certificate. 6. Verify the validity of the certificate. quit N/A See "Retrieving a certificate manually" N/A pki validate-certificate { ca | local } domain domain-name N/A Destroying a local RSA key pair A certificate has a lifetime, which is determined by the CA. When the private key leaks or the certificate is about to expire, you can destroy the old RSA key pair and then create a pair to request a new certificate. To destroy a local RSA key pair: Step 1. Enter system view. 2. Destroy a local RSA key pair. Command system-view public-key local destroy rsa 165

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
165
Step
Command
Remarks
4.
Set the CRL update period.
crl update-period
hours
Optional.
By default, the CRL update period
depends on the next update field in
the CRL file.
5.
Enable CRL checking.
crl check
enable
Optional.
Enabled by default.
6.
Return to system view.
quit
N/A
7.
Retrieve the CA certificate.
See "
Retrieving a certificate
manually
"
N/A
8.
Retrieve CRLs.
pki retrieval-crl domain
domain-name
N/A
9.
Verify the validity of a
certificate.
pki validate-certificate
{
ca
|
local
}
domain
domain-name
N/A
Configuring CRL-checking-disabled PKI certificate verification
To configure CRL-checking-disabled PKI certificate verification:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter PKI domain view.
pki domain
domain-name
N/A
3.
Disable CRL checking.
crl check
disable
Enabled by default
4.
Return to system view.
quit
N/A
5.
Retrieve the CA certificate.
See "
Retrieving a certificate
manually
"
N/A
6.
Verify the validity of the
certificate.
pki validate-certificate
{
ca
|
local
}
domain
domain-name
N/A
Destroying a local RSA key pair
A certificate has a lifetime, which is determined by the CA. When the private key leaks or the certificate
is about to expire, you can destroy the old RSA key pair and then create a pair to request a new
certificate.
To destroy a local RSA key pair:
Step
Command
1.
Enter system view.
system-view
2.
Destroy a local RSA key pair.
public-key local destroy rsa