pki import whitelist

Function

The pki import whitelist command imports certificate whitelist files to the device memory.

The virtual system does not support this command.

Format

pki import whitelist filename file-name

Parameters

Parameter	Description	Value
filename file-name	Specifies the name of a certificate whitelist file.	The value is a string of 1 to 64 case-insensitive characters without spaces or question marks.

Views

System view

Default Level

3: Management level

Usage Guidelines

Usage Scenario

In an LTE scenario, the device establishes IPSec tunnels with multiple base stations using certificate negotiation. The certificate whitelist is defined to facilitate unified management of base station certificates, determining the base stations allowed to establish IPSec tunnels with the device.

A certificate whitelist contains common names (CNs) in the certificate subjects of base stations. After PKI certificate whitelist check is enabled, the local device checks whether the CN in the certificate subject of the remote device carried in the received certificate authentication packet matches that in the local certificate whitelist. If not, authentication fails and an IPSec tunnel cannot be established between the two devices.

Before enabling PKI certificate whitelist check, run the pki import whitelist command to import the certificate whitelist file to the device memory.

Prerequisites

The certificate whitelist file already exists in the device's storage media.

Follow-up Procedure

Run the pki validate-certificate whitelist enable command to enable PKI certificate whitelist check.

Precautions

A certificate whitelist file is in the .XML format and uses the 7-bit ASCII coding mode. In the following example, two CNs are added to a certificate whitelist file.

<SerialnumberList>
<Serialnumber>CN-on-Certificate_of-RBS-1</Serialnumber>
<Serialnumber>CN-on-Certificate_of-RBS-2</Serialnumber>
</SerialnumberList>

A CN is a string of 1 to 128 case-sensitive characters, including letters, numerals, apostrophes ('), equal signs (=), parentheses (), plus signs (+), minus signs (-), periods (.), slashes (/), colons (:), at signs (@), underscores (_), and spaces.

When importing a certificate whitelist file, ensure that the file is stored in a specified directory, for example, the public directory in the root system. Run the following commands to access the public directory of the root system.

<sysname> cd pki
<sysname> cd public/

Example

# Import a certificate whitelist file to the device memory.

<sysname> system-view
[sysname] pki import whitelist filename whl.xml