H3C Technologies H3C WX6000 Series Access Controllers - Manual (Page 663)

68-16
Networking diagram
Figure 68-3 Diagram for configuring a certificate attribute-based access control policy
Configuration procedure
z
For detailed information about SSL configuration, refer to SSL-HTTPS in H3C WX6103 Access
Controller Switch Interface Board Configuration Guide .
z
For detailed information about HTTPS configuration, refer to SSL-HTTPS in H3C WX6103 Access
Controller Switch Interface Board Configuration Guide .
z
The PKI domain to be referenced by the SSL policy must be created in advance. For detailed
configuration of the PKI domain, refer to
Configure the PKI domain .
1) Configure the HTTPS server
# Configure the SSL policy for the HTTPS server to use.
<AC> system-view
[AC] ssl server-policy myssl
[AC-ssl-server-policy-myssl] pki-domain 1
[AC-ssl-server-policy-myssl] client-verify enable
[AC-ssl-server-policy-myssl] quit
2) Configure the certificate attribute group
# Create certificate attribute group mygroup1 and add two attribute rules. The first rule defines that the
DN of the subject name includes the string aabbcc, and the second rule defines that the IP address of
the certificate issuer is 10.0.0.1.
[AC] pki certificate attribute-group mygroup1
[AC-pki-cert-attribute-group-mygroup1] attribute 1 subject-name dn ctn aabbcc
[AC-pki-cert-attribute-group-mygroup1] attribute 2 issuer-name ip equ 10.0.0.1
[AC-pki-cert-attribute-group-mygroup1] quit
# Create certificate attribute group mygroup2 and add two attribute rules. The first rule defines that the
FQDN of the alternative subject name does not include the string of apple, and the second rule defines
that the DN of the certificate issuer name includes the string aabbcc.
[AC] pki certificate attribute-group mygroup2
[AC-pki-cert-attribute-group-mygroup2] attribute 1 alt-subject-name fqdn nctn apple
[AC-pki-cert-attribute-group-mygroup2] attribute 2 issuer-name dn ctn aabbcc
[AC-pki-cert-attribute-group-mygroup2] quit