444
<Sysname> system-view
[Sysname] pki storage certificates flash:/pki-new
# Specifies
pki-new
as the storage path for CRLs.
<Sysname> system-view
[Sysname] pki storage crls pki-new
pki validate-certificate
Use
pki validate-certificate
to verify the validity of certificates.
Syntax
pki validate-certificate
domain
domain-name
{
ca
|
local
}
Views
System view
Predefined user roles
network-admin
Parameters
domain-name
: Specifies a PKI domain by its name, a case-insensitive string of 1 to 31 characters.
The domain name cannot contain the special characters listed in
Table 65 Special characters
Character name
Symbol
Character name
Symbol
Tilde
~
Dot
.
Asterisk
*
Left angle bracket
<
Backslash
\
Right angle bracket
>
Vertical bar
|
Quotation marks
"
Colon
:
Apostrophe
'
ca
: Specifies the CA certificate.
local
: Specifies the local certificates.
Usage guidelines
Generally, certificates are automatically verified when you request, obtain, or import them, or when
an application uses PKI.
You can also use this command to manually verify a certificate in the following aspects:
•
Whether the certificate is issued by a trusted CA.
•
Whether the certificate has expired.
•
Whether the certificate is revoked. This check is performed only if CRL checking is enabled.
When CRL checking is enabled:
•
To verify the local certificates, if the PKI domain has no CRLs, the device looks up the locally
saved CRLs. If a correct CRL is found, the device loads the CRL to the PKI domain. If no correct
CRL is found locally, the device obtains a correct CRL from the CA server and saves it locally.
•
To verify the CA certificate, CRL checking is performed for the CA certificate chain from the
current CA to the root CA.
Summary of Contents for FlexNetwork MSR Series
Page 1005: ...987 ...
