 |
Note: SCEP sends a PKCS-10 format certificate request enveloped in PKCS-7 format. |
- Specify the challenge CA password for certificate enrollment and revocation—for example, aaa. If the CA does not provide the challenge password, then choose your own password.
- Specify at least one of the following values:
- Enter the domain name to identify the certificate owner in IKE negotiations—for example, qqq.juniper.net.
- Specify the identity of the certificate owner for IKE negotiation with the e-mail statement—for example, qqq@juniper.net.
- Enter an IP address if the Service router is configured for a static IP address—for example, 10.10.10.10.
- Specify the subject name in the distinguished name format
in quotation marks, including the domain component (DC), common name
(CN), organizational unit name (OU), organization name (O), locality
(L), state (ST), and country (C).
For example:
user@host> request security pki local-certificate enroll ca-profile wincs-5 certificate-id qqq challenge-password aaa domain-name qqq.juniper.net email qqq@juniper.net ip-address 10.10.10.10 subject DC=juniper, CN=router3, OU=marketing, O=juniper, L=sunnyvale, ST=california, C=us
The device certificate is obtained and the online enrollment begins for the certificate ID. The command is processed asynchronously.
