R3166-R3206-HP High-End Firewalls VPN Configuration Guide-6PW101

131
Table 28 Configuration task list for requesting a certificate manually
Task Remarks
Creating a PKI entity
Required
Create a PKI entity and configure the identity information.
A certificate is the binding of a public key and an entity, where an entity is the
collection of the identity information of a user. A CA identifies a certificate applicant by
entity.
The identity settings of an entity must be compliant to the CA certificate issue policy.
Otherwise, the certificate request may be rejected.
Creating a PKI
domain
Required
Create a PKI domain, setting the certificate request mode to Manual.
Before requesting a PKI certificate, an entity needs to be configured with some
enrollment information, which is referred to as a PKI domain.
A PKI domain is intended only for convenience of reference by other applications like
IKE and SSL, and has only local significance.
Generating an RSA
key pair
Required
Generate a local RSA key pair.
By default, no local RSA key pair exists.
Generating an RSA key pair is an important step in certificate request. The key pair
includes a public key and a private key. The private key is kept by the user, while the
public key is transferred to the CA along with some other information.
IMPORTANT:
If there is already a local certificate, remove the certificate before generating a new key
pair, so as to keep the consistency between the key pair and the local certificate.
Retrieving the CA
certificate
Required
Obtain the CA certificate and save it locally. For more information, see Retrieving a
certifi
cate.
Certificate retrieval serves two purposes:
• Locally store the certificates associated with the local security domain for improved
query efficiency and reduced query count,
• Prepare for certificate verification.
IMPORTANT:
If there are already CA certificates locally, you cannot perform the CA certificate retrieval
operation. This is to avoid possible mismatch between certificates and registration
information resulting from relevant changes. To retrieve the CA certificate, you need to
remove the CA certificate and local certificate first.