attribute
Use attribute to configure a rule to filter certificates based on an attribute in the certificate issuer name, subject name, or alternative subject name field.
Use undo attribute to remove an attribute rule.
Syntax
attribute id { alt-subject-name { fqdn | ip } | { issuer-name | subject-name } { dn | fqdn | ip } } { ctn | equ | nctn | nequ } attribute-value
undo attribute id
Default
No attribute rules exist.
Views
Certificate attribute group view
Predefined user roles
network-admin
mdc-admin
Parameters
id: Specifies a rule ID in the range of 1 to 16.
alt-subject-name: Specifies the alternative subject name field.
fqdn: Specifies the FQDN attribute.
ip: Specifies the IP address attribute.
dn: Specifies the DN attribute.
issuer-name: Specifies the issuer name field.
subject-name: Specifies the subject name field.
ctn: Specifies the contain operation.
equ: Specifies the equal operation.
nctn: Specifies the not-contain operation.
nequ: Specifies the not-equal operation.
attribute-value: Sets an attribute value, a case-insensitive string of 1 to 128 characters.
Usage guidelines
Different certificate fields support different attributes.
The subject name field and the issuer name field can contain a single DN, multiple FQDNs, and multiple IP addresses.
The alternative subject name field can contain multiple FQDNs and IP addresses but zero DNs.
An attribute rule is a combination of an attribute-value pair with an operation keyword, as listed in Table 21.
Table 21: Combinations of attribute-value pairs and operation keywords
Operation | DN | FQDN/IP |
|---|---|---|
ctn | The DN contains the specified attribute value. | Any FQDN or IP address contains the specified attribute value. |
nctn | The DN does not contain the specified attribute value. | None of the FQDNs or IP addresses contain the specified attribute value. |
equ | The DN is the same as the specified attribute value. | Any FQDN or IP address is the same as the specified attribute value. |
nequ | The DN is not the same as the specified attribute value. | None of the FQDNs or IP addresses are the same as the specified attribute value. |
A certificate matches an attribute rule if it contains an attribute that matches the criterion defined in the rule. For example, a certificate matches the attribute 1 subject-name dn ctn abc rule if it meets the following conditions:
The subject name field of the certificate contains the DN attribute.
The DN attribute value contains the abc string.
A certificate matches an attribute group if it matches all attribute rules in the group.
Examples
# Create a certificate attribute group and enter its view.
<Sysname> system-view [Sysname] pki certificate attribute-group mygroup
# Configure an attribute rule to match certificates that contain the abc string in the subject DN.
[Sysname-pki-cert-attribute-group-mygroup] attribute 1 subject-name dn ctn abc
# Configure an attribute rule to match certificates that do not contain FQDN abc in the issuer name field.
[Sysname-pki-cert-attribute-group-mygroup] attribute 2 issuer-name fqdn nequ abc
# Configure an attribute rule to match certificates that do not contain IP address 10.0.0.1 in the alternative subject name field.
[Sysname-pki-cert-attribute-group-mygroup] attribute 3 alt-subject-name ip nequ 10.0.0.1
Related commands
display pki certificate attribute-group
rule