HP 830 Series Configuration Manual page 54

[AC-pki-domain-1] ca identifier new-ca
[AC-pki-domain-1] certificate request url http://10.1.2.2/certsrv/mscep/mscep.dll
[AC-pki-domain-1] certificate request from ra
[AC-pki-domain-1] certificate request entity en
[AC-pki-domain-1] quit
# Create RSA local key pairs.
[AC] public-key local create rsa
# Retrieve the CA certificate from the certificate issuing server.
[AC] pki retrieval-certificate ca domain 1
# Request a local certificate from a CA through SCEP for the AC.
[AC] pki request-certificate domain 1
# Create an SSL server policy myssl, specify PKI domain 1 for the SSL server policy, and enable
certificate-based SSL client authentication.
[AC] ssl server-policy myssl
[AC-ssl-server-policy-myssl] pki-domain 1
[AC-ssl-server-policy-myssl] client-verify enable
[AC-ssl-server-policy-myssl] quit
# Create a certificate attribute group mygroup1, and configure a certificate attribute rule,
specifying that the distinguished name in the subject name includes the string new-ca.
[AC] pki certificate attribute-group mygroup1
[AC-pki-cert-attribute-group-mygroup1] attribute 1 issuer-name dn ctn new-ca
[AC-pki-cert-attribute-group-mygroup1] quit
# Create a certificate attribute-based access control policy myacp. Configure a certificate
attribute-based access control rule, specifying that a certificate is considered valid when it matches
an attribute rule in certificate attribute group myacp.
[AC] pki certificate access-control-policy myacp
[AC-pki-cert-acp-myacp] rule 1 permit mygroup1
[AC-pki-cert-acp-myacp] quit
# Associate the HTTPS service with SSL server policy myssl.
[AC] ip https ssl-server-policy myssl
# Associate the HTTPS service with certificate attribute-based access control policy myacp.
[AC] ip https certificate access-control-policy myacp
# Enable the HTTPS service.
[AC] ip https enable
# Create a local user named usera, set the password to 123 for the user, and specify the Web
service type for the local user.
[AC] local-user usera
[AC-luser-usera] password simple 123
[AC-luser-usera] service-type Web
[AC-luser-usera] authorization-attribute level 3
2. Configure the host (the HTTPS client):
On the host, run the IE browser. In the address bar, enter http://10.1.2.2/certsrv and request a
certificate for the host as prompted.
3. Verify the configuration:
48