Usage Scenario
Before applying for a certificate, run the sm2 pki local-key-pair create command to create a public and private key pair. During certificate application, the private key is kept by users; the public key and other information are sent to a CA for signature, and then a certificate is obtained.
If the key of a user is disclosed, the sm2 pki local-key-pair destroy command can be used to delete the original key pair. If a local certificate exists, deleting the local certificate triggers the generation of a new key pair. This ensures that the key pair matches the local certificate. If a key pair exists, the newly created key pair replaces the original key pair. Updating the key every 90 days is recommended.