Step

 

Remarks

 

 

Required.

 

 

Create a PKI domain, setting the certificate request mode to Manual.

2.

Creating a PKI domain

Before requesting a PKI certificate, an entity needs to be configured with

 

 

some enrollment information, which is called a PKI domain.

 

 

A PKI domain is intended only for convenience of reference by other

 

 

applications like IKE and SSL, and has only local significance.

 

 

 

 

 

Required.

 

 

Generate a local RSA key pair.

 

 

By default, no local RSA key pair exists.

 

 

Generating an RSA key pair is an important step in certificate request. The

3.

Generating an RSA key

key pair includes a public key and a private key. The private key is kept by

the user, and the public key is transferred to the CA along with some other

 

pair

 

information.

 

 

IMPORTANT:

If a local certificate already exists, you must remove the certificate before generating a new key pair, so as to keep the consistency between the key pair and the local certificate.

Required.

Certificate retrieval serves the following purposes:

•Locally store the certificates associated with the local security domain for improved query efficiency and reduced query count,

4. Retrieving the CA

• Prepare for certificate verification.

certificate

IMPORTANT:

 

If a local CA certificate already exists, you cannot perform the CA certificate retrieval operation. This will avoid possible mismatch between certificates and registration information resulting from relevant changes. To retrieve the CA certificate, you must remove the CA certificate and local certificate first.

 

Required.

 

When requesting a certificate, an entity introduces itself to the CA by

 

providing its identity information and public key, which will be the major

 

components of the certificate.

 

A certificate request can be submitted to a CA in online mode or offline

 

mode.

5. Requesting a local

• In online mode, if the request is granted, the local certificate will be

retrieved to the local system automatically.

certificate

• In offline mode, you must retrieve the local certificate by an out-of-band

 

means.

 

IMPORTANT:

 

If a local certificate already exists, you cannot perform the local certificate

 

retrieval operation. This will avoid possible mismatch between the local

 

certificate and registration information resulting from relevant changes. To

 

retrieve a new local certificate, you must remove the CA certificate and local

 

certificate first.

387