HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

261
# Configure the SSL policy for the HTTPS server.
<Router> system-view
[Router] ssl server-policy myssl
[Router-ssl-server-policy-myssl] pki-domain 1
[Router-ssl-server-policy-myssl] client-verify enable
[Router-ssl-server-policy-myssl] quit
2. Configure the certificate attribute group.
# Create certificate attribute group mygroup1 and add two attribute rules. The first rule defines
that the DN of the subject name includes the string aabbcc, and the second rule defines that
the IP address of the certificate issuer is 10.0.0.1.
[Router] pki certificate attribute-group mygroup1
[Router-pki-cert-attribute-group-mygroup1] attribute 1 subject-name dn ctn aabbcc
[Router-pki-cert-attribute-group-mygroup1] attribute 2 issuer-name ip equ 10.0.0.1
[Router-pki-cert-attribute-group-mygroup1] quit
# Create certificate attribute group mygroup2 and add two attribute rules. The first rule defines
that the FQDN of the alternative subject name does not include the string of apple, and the
second rule defines that the DN of the certificate issuer name includes the string aabbcc.
[Router] pki certificate attribute-group mygroup2
[Router-pki-cert-attribute-group-mygroup2] attribute 1 alt-subject-name fqdn nctn
apple
[Router-pki-cert-attribute-group-mygroup2] attribute 2 issuer-name dn ctn aabbcc
[Router-pki-cert-attribute-group-mygroup2] quit
3. Configure a certificate access control policy:
# Create the certificate access control policy of myacp.
[Router] pki certificate access-control-policy myacp
# Define a statement to deny the certificates that match the attribute rules in the certificate
attribute group mygroup1.
[Router-pki-cert-acp-myacp] rule 1 deny mygroup1
# Define a statement to permit the certificates that match the attribute rules in the certificate
attribute group mygroup2.
[Router-pki-cert-acp-myacp] rule 2 permit mygroup2
[Router-pki-cert-acp-myacp] quit
4. Apply the SSL server policy and certificate access control policy to HTTPS service and enable
HTTPS service.
# Apply SSL server policy myssl to HTTPS service.
[Router] ip https ssl-server-policy myssl
# Apply certificate access control policy myacp to HTTPS service.
[Router] ip https certificate access-control-policy myacp
# Enable HTTPS service.
[Router] ip https enable

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English