Contents

HTTP proxy commands· 1

access-record enable· 1

display http-proxy· 2

dns-server 4

domain-name· 5

http-proxy server-group· 6

http-proxy service· 7

hyperlink-proxy· 7

ip-address· 8

ip-pool 9

ipv6-address· 10

medialink-proxy enable· 11

protocol-type (Web server group view) 11

protocol-type (http proxy service view) 12

service enable· 13

ssl certificate file· 14

ssl certificate key-file· 15

 

HTTP proxy commands

 

access-record enable

Use access-record enable to enable the HTTP proxy operation recording and specify the directory for saving the HTTP proxy operation recording file.

Use undo access-record enable to restore the default.

Syntax

access-record enable file-path path

undo access-record enable

Default

The HTTP proxy operation recording is disabled and no directory is specified for saving the HTTP proxy operation recording file.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

file-path path: Specifies a file path. (In standalone mode.)

file-path path: Specifies a file path. The file path specified by the path argument must include the slot number in the format of slotn# to specify the location of the storage media. The n indicates the slot number of the module that has storage media. (In IRF mode.)

Usage guidelines

The proxy information of an HTTP proxy service will be recorded in the HTTP proxy operation recording file in the descending order of the time. For example, the proxy information is recorded in the HTTP proxy operation recording file as follows:

[03/Dec/2019:16:11:35 +0800] Client=2001::1 URL=http://www.domain.com/index.html Server=172.16.28.12:80

·     The [03/Dec/2019:16:11:35 +0800] field includes the access time and time zone of the client.

·     The 2001::1 field is the IPv6 address of the client.

·     The http://www.domain.com/index.html field is the address requested by the client.

·     The 172.16.28.12:80 field is the IPv4 address of the Web server accessed by the client.

Examples

# (In standalone mode.) Enable the HTTP proxy operation recording and specify the directory for saving the HTTP proxy operation recording file.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] access-record enable file-path flash:/httpproxy/20191010.log

# (In IRF mode.) Enable the HTTP proxy operation recording and specify the directory for saving the HTTP proxy operation recording file.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] access-record enable file-path slot1#flash:/httpproxy/20191010.log

Related commands

http-proxy service

display http-proxy

Use display http-proxy to display HTTP proxy configuration information.

Syntax

display http-proxy { server-group [ group-name ] | service [ service-name ] }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

server-group: Specifies a Web server group.

group-name: Specifies a Web server group by its name, a case-insensitive string of 1 to 63 characters. The name can include digits, letters, and underscores (_). If you do not specify a Web server group, this command displays configuration information about all Web server groups.

service: Specifies an HTTP proxy service.

service-name: Specifies an HTTP proxy service by its name, a case-insensitive string of 1 to 63 characters. The name can include digits, letters, and underscores (_). If you do not specify an HTTP proxy service, this command displays configuration information about all HTTP proxy services.

Examples

# Display the configuration information about Web server group test.

<Sysname> display http-proxy server-group test

Server group name: test

  Protocol type:        http

  Server IP addresses:  192.168.10.10

                        192.168.10.12

                        192.168.10.14:8080

Table 1 Command output

Field	Description
Server group name	Web server group name.
Protocol type	Protocol type of the Web server group. This field displays N/A if no protocol type is specified for the Web server group.
Server IP addresses	IP addresses and port numbers of the Web servers in the Web server group. This field displays N/A if no Web server is in the Web server group.

 

# Display the configuration information about HTTP proxy service test.

<Sysname> display http-proxy service test

Service name: test

  IPv6 address:                    2001::1

  Domain name:                     test.gov.cn

  Protocol types:                  HTTP at port 8000

                                   HTTP  [Server group: testa]

                                   HTTP at port 8001 [Server group: testa]

                                   HTTPS at port 8003

                                   HTTPS [Server group: testb]

                                   HTTPS at port 8002 [Server group: testb]

  SSL certificate file:            flash:/cert.pem

  SSL certificate key-file:        flash:/cert.key

  Hyperlink proxy strings:         www.hyperlink.org

  DNS server:                      8.8.8.8

  IP pools:                        1.1.1.1 to 1.1.1.2 vpn1

                                   2.2.2.1 to 2.2.3.1

  Medialink proxy:                 Enabled

  HTTP proxy operation recording:  Enabled

    Operation record file path:    flash:/httpproxy/20191010.log

  HTTP proxy status:               Enabled

Table 2 Command output

Field	Description
HTTP proxy name	HTTP proxy service name.
IPv6 address	IPv6 address specified for the HTTP proxy service, which can be resolved from the specified domain name. This field displays N/A if no IPv6 address is specified for the HTTP proxy service.
Domain name	Domain name specified for the HTTP proxy service, which can be resolved to the specified IPv6 address. This field displays N/A if no domain name is specified for the HTTP proxy service.
Protocol types	Protocol types specified for the HTTP proxy service, listening port number, and the Web server groups bound to the HTTP proxy service. This field displays N/A if no protocol types are specified for the HTTP proxy service.
SSL certificate file	SSL certificate file specified for the HTTP proxy service. This field displays N/A if no SSL certificate file is specified for the HTTP proxy service.
SSL certificate key-file	SSL certificate key file specified for the HTTP proxy service. This field displays N/A if no SSL certificate key file is specified for the HTTP proxy service.
Hyperlink proxy strings	External hyperlink match strings specified for the HTTP proxy service. This field displays N/A if no external hyperlink strings are specified for the HTTP proxy service.
DNS server	IP address of the DNS server. This field displays N/A if no IP address is specified for the DNS server.
IP pools	Source IP pools used for Web server connection. This field displays N/A if no IP pool is specified for the HTTP proxy.
Medialink proxy	Status of the external media link proxy feature: ·     Enabled. ·     Disabled.
HTTP proxy operation recording	Status of the HTTP proxy operation recording feature: ·     Enabled. ·     Disabled.
Operation record file path	Directory for saving the HTTP proxy operation recording file. This field displays N/A if no directory is specified for saving the HTTP proxy operation recording file.
HTTP proxy status	Status of the HTTP proxy service: ·     Enabled. ·     Disabled.

 

Related commands

http-proxy server-group

http-proxy service

dns-server

Use dns-server to specify a DNS server for an HTTP proxy service.

Use undo dns-server to remove a DNS server for an HTTP proxy service.

Syntax

dns-server ip-address

undo dns-server ip-address

Default

No DNS servers are specified for an HTTP proxy service.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

ip-address: Specifies a DNS server by its IPv4 address.

Usage guidelines

Configure a minimum of one DNS server for an HTTP proxy service to resolve the domain names of the external hyperlinks and media links to be proxied on webpages of the Web servers.

Execute this command when the HTTP proxy service is disabled.

A maximum of two DNS servers can be specified for an HTTP proxy service.

Examples

# (In standalone mode.) Specify DNS server at 8.8.8.8 for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] dns-server 8.8.8.8

# (In IRF mode.) Specify DNS server at 8.8.8.8 for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] dns-server 8.8.8.8

Related commands

hyperlink-proxy

medialink-proxy enable

domain-name

Use domain-name to specify a domain name for an HTTP proxy service.

Use undo domain-name to delete the domain name for an HTTP proxy service.

Syntax

domain-name domain-name

undo domain-name

Default

No domain name is specified for an HTTP proxy service.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

domain-name: Specifies a domain name, a case-insensitive string of 1 to 253 characters. The domain name can include dot-separated domain name suffixes (aabbcc.com, for example). Each domain name suffix can contain a maximum of 63 characters. Valid characters in the domain name string include letters, digits, hyphens (-), and underscores (_).

Usage guidelines

This command enables you to access an external webpage resource on the Web servers by adding the specified domain name to the domain name of the external webpage resource. The DNS server specified for the HTTP proxy service will resolve the domain names.

Execute this command when the HTTP proxy service is disabled.

The specified domain name must be the same as the actual domain name of the accessed Web server group.

Examples

# (In standalone mode.) Specify domain name test.gov.cn for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] domain-name test.gov.cn

# (In IRF mode.) Specify domain name test.gov.cn for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] domain-name test.gov.cn

Related commands

service enable

http-proxy server-group

Use http-proxy server-group to create a Web server group and enter its view, or enter the view of an existing Web server group.

Use undo http-proxy server-group to delete a Web server group.

Syntax

http-proxy server-group group-name

undo http-proxy server-group group-name

Default

No Web server groups exist.

Views

System view

Predefined user roles

network-admin

Parameters

group-name: Specifies the name of the Web server group, a case-insensitive string of 1 to 63 characters. The name can include digits, letters, and underscores (_).

Usage guidelines

You cannot delete the Web server group that has been bound to an HTTP proxy service no matter whether the HTTP proxy service is enabled.

Examples

# Create Web server group test and enter its view.

<Sysname> system-view

[Sysname] http-proxy server-group test

[Sysname-http-proxy-server-group-test]

Related commands

protocol-type (HTTP proxy service view)

http-proxy service

Use http-proxy service to create an HTTP proxy service and enter its view, or enter the view of an existing HTTP proxy service.

Use undo http-proxy service to delete an HTTP proxy service.

Syntax

In standalone mode:

http-proxy service service-name

undo http-proxy service service-name

In IRF mode:

http-proxy service service-name slot slot-number

undo http-proxy service service-name slot

Default

No HTTP proxy services exist.

Views

System view

Predefined user roles

network-admin

Parameters

service service-name: Specifies an HTTP proxy service by its name, a case-insensitive string of 1 to 63 characters. The name can include digits, letters, and underscores (_).

slot slot-number: Specifies an IRF member device by its member ID. (In IRF mode.)

Examples

# (In standalone mode.) Create HTTP proxy service test and enter its view.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test]

# (In IRF mode.) Create HTTP proxy service test on a module and enter its view.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1]

Related commands

service enable

hyperlink-proxy

Use hyperlink-proxy to specify an external hyperlink to be proxied on webpages.

Use undo hyperlink-proxy to remove an external hyperlink to be proxied on webpages.

Syntax

hyperlink-proxy link-string

undo hyperlink-proxy link-string

Default

No external hyperlinks to be proxied are specified on webpages.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

link-string: Specifies the URL of an external hyperlink, a case-insensitive string of 1 to 253 characters. The string can include letters, digits, hyphens (-),underscores (_), slashes (/), and dots (.).

Usage guidelines

This feature enables users to access external hyperlinks on webpages of Web servers proxied by the HTTP proxy service.

Execute this command when the HTTP proxy service is disabled.

The HTTP proxy service will proxy all specified external hyperlinks on the webpages requested by users, which might cause security risks. Please use this feature with cautions.

To use this feature, you must also configure the domain-name and dns-server commands.

Examples

# (In standalone mode.) Specify external hyperlink www.hyperlink.org to be proxied by HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] hyperlink-proxy www.hyperlink.org

# (In IRF mode.) Specify external hyperlink www.hyperlink.org to be proxied by HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] hyperlink-proxy www.hyperlink.org

Related commands

dns-server

domain-name

ip-address

Use ip-address to add a Web server to a Web server group.

Use undo ip-address to remove a Web server from a Web server group.

Syntax

ip-address ip-address [ port port-number ]

undo ip-address ip-address [ port port-number ]

Default

No Web servers exist in a Web server group.

Views

Web server group view

Predefined user roles

network-admin

Parameters

ip-address: Specifies the IPv4 address of the Web server.

port port-number: Specifies the port number of the Web server, in the range of 1 to 65535.

Usage guidelines

You can repeat this command to add multiple Web servers to a Web server group.

If a Web server group has been bound to an HTTP proxy service, you cannot modify the IP address or port number of any Web server in this Web server group.

Examples

# Add the Web server with IP address 10.1.1.10 and port number 8000 to Web server group test.

<Sysname> system-view

[Sysname] http-proxy server-group test

[Sysname-http-proxy-server-group-test] ip-address 10.1.1.10 port 8000

ip-pool

Use ip-pool to configure a source IP pool used for Web server connection.

Use undo ip-pool to delete the source IP pool used for Web server connection.

Syntax

ip-pool start-address end-address [ vpn-instance vpn-instance-name ]

undo ip-pool [ start-address end-address [ vpn-instance vpn-instance-name ] ]

Default

No source IP pools are specified for Web server connection.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

start-address end-address: Specifies the start IP address and end IP address of a source IP pool. The end address cannot be lower than the start address. If the start and end IP addresses are the same, the source IP pool has only one IP address.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VPN instance, the IP pool is on the public network.

Usage guidelines

By default, the HTTP proxy uses the IP address of the outgoing interface in the default route to establish TCP connections with Web servers. An IP address supports a maximum of 65535 TCP connections. To allow the HTTP proxy to establish more TCP connections with Web servers, you can use this command to configure source IP pools. The HTTP proxy will use an IP address in the source IP pool for Web server connection.

You can execute this command multiple times to specify a maximum of 64 source IP pools. An IP pool can contain a maximum of 512 IP addresses. The IP addresses in different source IP pools cannot overlap with each other.

The source IP pools configured in the same HTTP proxy service must belong to the same VPN instance. The IP pools configured in the different HTTP proxy services must belong to different VPN instances.

Examples

# (In standalone mode.) Configure a source IP pool that contains IP addresses 1.1.1.1 through 1.1.1.100 and belongs to VPN instance vpn1 for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] ip-pool 1.1.1.1 1.1.1.100 vpn-instance vpn1

# (In IRF mode.) Configure a source IP pool that contains IP addresses 1.1.1.1 through 1.1.1.100 and belongs to VPN instance vpn1 for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] ip-pool 1.1.1.1 1.1.1.100 vpn-instance vpn1

ipv6-address

Use ipv6-address to specify an IPv6 address for an HTTP proxy service.

Use undo ipv6-address to delete the IPv6 address for an HTTP proxy service.

Syntax

ipv6-address ipv6-address

undo ipv6-address

Default

No IPv6 address is specified for an HTTP proxy service.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

ipv6-address: Specifies an IPv6 address for an HTTP proxy service.

Usage guidelines

You can use the specified IPv6 address of an HTTP proxy service to establish a communication between the devices and the Web server group bound with the HTTP proxy service.

Execute this command when the HTTP proxy service is disabled.

Examples

# (In standalone mode.) Specify 2001::1 as the IPv6 address of HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] ipv6-address 2001::1

# (In IRF mode.) Specify 2001::1 as the IPv6 address of HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] ipv6-address 2001::1

Related commands

service enable

medialink-proxy enable

Use dns-server to enable the external media link proxy feature.

Use undo dns-server to disable the external media link proxy feature.

Syntax

medialink-proxy enable

undo medialink-proxy enable

Default

The external media link proxy feature is disabled.

Views

HTTP proxy service view

Predefined user roles

network-admin

Usage guidelines

This feature enables users to access external media files linked to webpages of the Web servers proxied by the HTTP proxy service.

To use this feature, you must also configure the domain-name and dns-server commands.

Examples

# (In standalone mode.) Enable the external media link proxy feature for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-server-service-test] medialink-proxy enable

# (In IRF mode.) Enable the external media link proxy feature for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] medialink-proxy enable

Related commands

dns-server

domain-name

protocol-type (Web server group view)

Use protocol-type to specify a protocol type for a Web server group.

Use undo protocol-type to delete the protocol settings for a Web server group.

Syntax

protocol-type { http | https }

undo protocol-type

Default

No protocol types are specified for a Web server group.

Views

Web server group view

Predefined user roles

network-admin

Parameters

http: Specifies the HTTP protocol.

https: Specifies the HTTPS protocol.

Usage guidelines

If a Web server group has been bound to an HTTP proxy service, you cannot change the protocol type specified for a Web server group.

The HTTP proxy uses the specified protocol to encapsulate HTTP or HTTPS requests sent to Web servers in the Web server group.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Specify HTTP as the protocol type of Web server group test.

<Sysname> system-view

[Sysname] http-proxy server-group test

[Sysname-http-proxy-server-group-test] protocol-type http

protocol-type (http proxy service view)

Use protocol-type to specify a protocol type and listening port number for an HTTP proxy service and bind a Web server group to the service.

Use undo protocol-type to delete the protocol and listening port settings for an HTTP proxy service and unbind the Web server group from the service.

Syntax

protocol-type { http | https } [ port port-number ] [ server-group group-name ]

undo protocol-type { http | https } [ port port-number ] [ server-group group-name ]

Default

No protocol type or listening port number is specified for an HTTP proxy service and no Web server group is bound to the HTTP proxy service.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

http: Specifies the HTTP protocol.

https: Specifies the HTTPS protocol.

port port-number: Specifies the port number on which the HTTP proxy service listens. The value range is 1 to 65535. The default listening port number for the HTTP protocol and HTTPS protocol is 80 and 443, respectively.

server-group group-name: Specifies a Web server group by its name, a case-insensitive string of 1 to 63 characters. The name can include digits, letters, and underscores (_). If you do not specify this option, the device can access all Web servers.

Usage guidelines

With this command configured, if the IPv6 client uses the specified protocol and port number to access a Web server:

·     For an IPv6 Web server, the HTTP proxy directly forwards the IPv6 packets received from the client to the Web server.

·     For an IPv4 Web server, the HTTP proxy first converts the IPv6 packets of the client to IPv4 packets. Then the HTTP proxy uses the specified protocol to encapsulate the packets before sending them to the specified Web server.

To access different Web servers, you can execute this command multiple times to configure multiple listening ports and Web server groups for an HTTP proxy service.

As a best practice, do not bind HTTP proxy services of different protocol types to the same Web server group. One port number can be bound to only one Web server group that has been specified with a protocol type and contains Web servers.

Examples

# (In standalone mode.) Specify HTTP and port number 8000 as the protocol type and listening port number of HTTP proxy service test and bind Web server group grouptest to the HTTP proxy service.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] protocol-type http port 8000 server-group grouptest

# (In IRF mode.) Specify HTTP and port number 8000 as the protocol type and listening port number of HTTP proxy service test and bind Web server group grouptest to the HTTP proxy service.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] protocol-type http port 8000 server-group grouptest

service enable

Use service enable to enable an HTTP proxy service.

Use undo service enable to disable an HTTP proxy service.

Syntax

service enable

undo service enable

Default

An HTTP proxy service is disabled.

Views

HTTP proxy service view

Predefined user roles

network-admin

Usage guidelines

The HTTP proxy service requires a license. For more information about licenses, see license management in Fundamentals Configuration Guide.

Before enable an HTTP proxy service, perform the following tasks:

·     Specify a protocol type for the HTTP proxy service and bind a Web server group to the service.

·     Specify an IPv6 address for the HTTP proxy service.

·     If HTTPS is specified as the protocol type for the HTTP proxy service, specify an SSL certificate file and SSL certificate key file for the service by using the ssl certificate file and ssl certificate key-file commands, respectively.

·     If you enable the external media link proxy feature (by using medialink-proxy enable) or specify external hyperlinks to be proxied on webpages (by using hyperlink proxy), configure the dns-server command.

If an HTTP proxy service has been enabled, you can execute only the access-record enable command in the view of this service.

Examples

# (In standalone mode.) Enable HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] service enable

# (In IRF mode.) Enable HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] service enable

Related commands

dns-server

domain-name

hyperlink-proxy

ipv6-address

medialink-proxy enable

protocol-type (HTTP proxy service view)

ssl certificate file

ssl certificate key-file

ssl certificate file

Use ssl certificate file to specify an SSL certificate file.

Use undo ssl certificate file to restore the default.

Syntax

ssl certificate file certificate-file

undo ssl certificate file

Default

No SSL certificate file is specified.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

certificate-file: Specifies an SSL certificate file.

certificate-file: Specifies an SSL certificate file. The file path specified by the certificate-file argument must be on the storage media of the active MPU or master device.(In IRF mode.)

Usage guidelines

For an HTTP proxy service to proxy HTTPS requests, you must specify an SSL certificate file for the HTTP proxy service.

After you execute this command on a centralized IRF device or distributed device, the system will examine whether the specified SSL certificate file exists on the master device or active MPU:

·     If yes, the configuration succeeds.

·     If not, the configuration fails.

Before executing this command, copy the SSL certificate file to the same directory as the master device or active MPU on all subordinate devices or standby MPUs. This operation ensures that the settings of an HTTP proxy service can restore successfully after a master/subordinate or active/standby switchover.

You must specify an SSL certificate file for an HTTP proxy service before enabling the HTTP proxy service. Otherwise, the HTTP proxy service cannot correctly proxy HTTPS requests.

Before modifying the SSL certificate file for an HTTP proxy service, first disable the HTTP proxy service.

Examples

# (In standalone mode.) Specify SSL certificate file cert.pem for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] ssl certificate file flash:/cert.pem

# (In IRF mode.) Specify SSL certificate file cert.pem for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] ssl certificate file flash:/cert.pem

Related commands

protocol-type (HTTP proxy service view)

ssl certificate key-file

Use ssl certificate key-file to specify an SSL certificate key file.

Use undo ssl certificate key-file to restore the default.

Syntax

ssl certificate key-file key-file

undo ssl certificate key-file

Default

No SSL certificate key file is specified.

Views

HTTP proxy service view

Predefined user roles

network-admin

Parameters

key-file: Specifies an SSL certificate key file. (In standalone mode.)

key-file: Specifies an SSL certificate key file. The file path specified by the key-file argument must be on the storage media of the active MPU or master device. (In IRF mode.)

Usage guidelines

For an HTTP proxy service to proxy HTTPS requests, you must specify an SSL certificate key file for the HTTP proxy service.

After you execute this command on a centralized IRF device or distributed device, the system will examine whether the specified SSL certificate key file exists on the master device or active MPU:

·     If yes, the configuration succeeds.

·     If not, the configuration fails.

Before executing this command, copy the SSL certificate key file to the same directory as the master device or active MPU on all subordinate devices or standby MPUs. This operation ensures that the settings of an HTTP proxy service can restore successfully after a master/subordinate or active/standby switchover.

You must specify an SSL certificate key file for an HTTP proxy service before enabling the HTTP proxy service. Otherwise, the HTTP proxy service cannot correctly proxy HTTPS requests.

Before modifying the SSL certificate key file for an HTTP proxy service, first disable the HTTP proxy service.

Examples

# (In standalone mode.) Specify SSL certificate key file cert.key for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test

[Sysname-http-proxy-service-test] ssl certificate key-file flash:/cert.key

# (In IRF mode.) Specify SSL certificate file cert.key for HTTP proxy service test.

<Sysname> system-view

[Sysname] http-proxy service test slot 1

[Sysname-http-proxy-service-test-slot1] ssl certificate key-file flash:/cert.key

Related commands

protocol-type (HTTP proxy service view)