CLI Operation

1. To generate a certificate request using the certificate ID (ca-ipsec) of a public-private key pair you previously generated and specifying the domain name juniper.net and the associated common name abc, enter the following command:

   user@host> request security pki generate-certificate-request certificate-id ca-ipsec domain-name juniper.net subject CN=abc

   The following certificate request is displayed in PEM format.

   Generated certificate request 
   -----BEGIN CERTIFICATE REQUEST----- 
   MIHxMIGcAgEAMA4xDDAKBgNVBAMTA2htMTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgC 
   QQCbhaiWzmctH0ZDldCn+mSNM62kyiSgc4cmN68U/j9El09/DgGoMNy2y+RYA1xU 
   sr4B0NedGrZZJx5L1sIYjHr/AgMBAAGgKTAnBgkqhkiG9w0BCQ4xGjAYMBYGA1Ud 
   EQQPMA2CC2p1bmlwZXIubmV0MA0GCSqGSIb3DQEBBQUAA0EAleLR6Hp2ity8Dugs 
   MW4HI6SxfwMc2eYM5Nj2UhwpEEpsce77dUBZriKdehAgli7vwNsHGIuhHjEaFzfO 
   hpM3tA== 
   -----END CERTIFICATE REQUEST----- 
   Fingerprint: 
   9e:d5:7d:44:e8:e7:b6:d7:4b:58:d4:4e:2b:fb:c6:b2:4b:b7:8b:82 (sha1) 
   b0:8d:c7:6d:41:d5:58:61:dc:a0:3e:4e:d6:39:02:d7 (md5) 
   

   Copy the generated certificate request and paste it into the appropriate field at the CA Web site to obtain a local certificate. Refer to the CA server documentation to determine where to paste the certificate-request.

   When PKCS-10 content is displayed, the SHA-1 hash and MD5 hash of the PKCS-10 file is also displayed. For more information on the certificate, such as the bit length of the key pair, use the command show security pki certificate-request described in the JUNOS Software CLI Reference.

2. Go on to Loading CA and Local Certificates Manually.