HP MSR2000/3000/4000 Router Series Security Command Reference

184
# Request the local certificates.
[Sysname] pki request-certificate domain openca
Start to request the general certificate ...
…
Request certificate of domain openca successfully
Related commands
display pki certificate
pki retrieve-certificate
Use pki retrieve-certificate to obtain a certificate from the certificate distribution server.
Syntax
pki retrieve-certificate domain domain-name { ca | local | peer entity-name }
Views
System view
Predefined user roles
network-admin
Parameters
domain domain-name: Specifies the name of a PKI domain, a case-insensitive string of 1 to 31 characters.
The domain name cannot contain the following special characters: tilde (~), asterisk (*), back slash (\),
vertical bar (|), colon (:), dot (.), left angle bracket (<), right angle bracket (>), quotation marks ("), and
apostrophe (').
ca: Specifies the CA certificate.
local: Specifies the local certificates.
peer entity-name: Specifies a peer entity by its name, a case-insensitive string of 1 to 31 characters.
Usage guidelines
In online mode, you can obtain the CA certificate through the SCEP protocol. If a CA certificate already
exists locally, do not obtain the CA certificate again. To obtain a new one, use the pki delete-certificate
command to remove the CA certificate and local certificates, and then obtain the CA certificate again.
In online mode, you can obtain local certificates or peer certificates through the LDAP protocol. If a PKI
domain already has local certificates or peer certificates, you can still perform the obtain operation and
the obtained local certificates or peer certificates overwrite the existing ones. If RSA is used, a PKI
domain can have two local certificates, one for signing and the other for encryption. Certificates for
different purposes do not overwrite each other.
The obtained CA certificate, local certificates, and peer certificates are automatically verified before they
are saved locally. If the verification fails, they are not saved.
This command is not saved in the configuration file.
Examples
# Obtain the CA certificate from the certificate distribution server. (This operation requires the user to
confirm the fingerprint of the CA root certificate.)
<Sysname> system-view
[Sysname] pki retrieve-certificate domain aaa ca