132a. Use pki request-certificate domain pkcs10 to print the request information on the terminal oruse pki request-certificate domain pkcs10 filename to save the request information to a localfile.b. Send the printed information or the saved file to the CA by an out-of-band means to submit therequest.• Online mode—A certificate request can be automatically or manually submitted. The followingsections describe the online request mode.Configuring automatic certificate requestIMPORTANT:If an automatically requested certificate will soon expire or has expired, the entity does not initiate are-request to the CA automatically, and the applications using the certificate might be interrupted.In auto request mode, a PKI entity automatically submits a certificate request to the CA when anapplication works with the PKI entity that does not have a local certificate. The entity saves the certificatelocally after obtaining it from the CA.A CA certificate must be present before you request a local certificate. If no CA certificate exists in the PKIdomain, the PKI entity automatically obtains a CA certificate before sending a certificate request.Configuration guidelines• Make sure the system time is synchronized with the CA server. Otherwise, the certificate requestprocess might fail because the certificate might be regarded out of the validity period. Forinformation about how to change the system time, see Fundamentals Configuration Guide.• If a local certificate exists, do not use the public-key local create or public-key local destroycommand to generate or destroy a key pair with the same name as the key pair in the existing localcertificate. Otherwise, the existing local certificate becomes unavailable. To request a new localcertificate, use the pki delete-certificate command to remove the existing local certificate, and thenuse the public-key local create or public-key local destroy command to generate a new key pair ordestroy the key pair associated with the original local certificate.Configuration procedureTo configure automatic certificate request:Step Command Remarks1. Enter system view. system-view N/A2. Enter PKI domain view. pki domain domain-name N/A3. Set the certificate requestmode to auto.certificate request mode auto [ password{ cipher | simple } password ]By default, the manualrequest mode applies.In auto request mode, set apassword for certificaterevocation if the CA policyrequires the password.
