Maintaining PKI

Maintaining certificates involves deleting certificates and deleting RSA key pairs.

If the current version is downgraded to a version earlier than V800R021C00, run the dir ca_config.ini command in the user view to query the size of the current PKI configuration file. If the file size exceeds 19 KB, the PKI certificate import and deletion functions cannot be used after the downgrade. Therefore, you need to delete some certificates before the downgrade and ensure that the file size is less than 19 KB.

Deleting Certificates

When a certificate with a specific name expires, delete the certificate. When a key is disclosed, delete all related CA certificates, the related local certificate, and re-send a certificate application.

Deleting RSA Key Pairs

When a user's key is disclosed, the corresponding key pair must be deleted, and a new key pair needs to be created.

Clearing CMP Session Statistics

To re-collect CMP session statistics within a specific period, clear existing CMP session statistics.

Updating the Expired Local Certificate and CRL Certificate

If the local certificate or CRL certificate expires, you need to update it.