Deleting a Certificate 1229
n
For details about the public-key local destroy rsa command, refer to “SSH
Configuration” on page 1107.
Deleting a Certificate When a certificate requested manually is about to expire or you want to request a
new certificate, you can delete the current local certificate or CA certificate.
Follow these steps to delete a certificate:
Configuring an Access
Control Policy
By configuring a certificate attribute-based access control policy, you can further
control access to the server, providing additional security for the server.
Follow these steps to configure a certificate attribute-based access control policy:
c
CAUTION: A certificate attribute group must exist to be associated with a rule.
Displaying and
Maintaining PKI
Destroy a local RSA key pair public-key local destroy rsa Required
To do… Use the command… Remarks
To do… Use the command… Remarks
Enter system view system-view -
Delete certificates pki delete-certificate { ca | local }
domain domain-name
Required
To do… Use the command… Remarks
Enter system view system-view -
Create a certificate attribute
group and enter its view
pki certificate
attribute-group group-name
Required
No certificate attribute group
exists by default.
Configure an attribute rule for
the certificate issuer name,
certificate subject name, or
alternative subject name
attribute id
{ alt-subject-name { fqdn |
ip } | { issuer-name |
subject-name } { dn | fqdn |
ip }} {ctn | equ | nctn |
nequ} attribute-value
Optional
There is no restriction on the
issuer name, certificate
subject name and alternative
subject name by default.
Return to system view quit -
Create a certificate
attribute-based access control
policy and enter its view
pki certificate
access-control-policy
policy-name
Required
No access control policy exists
by default.
Configure a certificate
attribute-based access control
rule
rule [ id ] { deny | permit }
group-name
Required
No access control rule exists
by default.
To do… Use the command… Remarks
Display the contents or
request status of a certificate
display pki certificate {{ca | local }
domain domain-name | request-status }
Available in any
view
To Next Page
Loading...
