• If the specified URL of the CRL repository is in HTTP format, the device obtains CRLs through the
HTTP protocol.
• If the specified URL of the CRL repository is in LDAP format, the device obtains CRLs through the
LDAP protocol. If the specified URL (by using the crl url command) does not have a host name, for
example, ldap:///CN=8088,OU=test,U=rd,C=cn, you must specify the URL of the LDAP server for
the PKI domain by using the ldap server command. In this case, the device combines the URL of the
LDAP server and the URL of the CRL repository to form a complete URL of the LDAP repository to
obtain CRLs through the LDAP protocol.
• If the PKI domain is not configured with the CRL repository, the device looks up the local certificates
and then the CA certificate for the CRL repository. If a CRL repository is found, the device obtains
CRLs from the point. Otherwise, the device obtains CRLs through the SCEP protocol.
Examples
# Obtain CRLs from the CRL repository.
<Sysname> system-view
[Sysname] pki retrieve-crl domain aaa
Related commands
• crl url
• ldap server
pki storage
Use pki storage to specify the storage path for the certificates or CRLs.
Use undo pki storage to restore the default.
Syntax
pki storage { certificates | crls } dir-path
undo pki storage { certificates | crls }
Default
The storage path for the certificates and CRLs is the PKI directory on the storage media of the device.
Views
System view
Predefined user roles
network-admin
Parameters
certificates: Specifies a storage path for the certificates.
crls: Specifies a storage path for the CRLs.
215
To Next Page
Loading...
Need help?
General
