ChangelogDownloads
HomeGuidesChangelog
ChangelogDownloadsSupportMulti-service IoT Edge GatewaysEUROTECH
Guides
SupportMulti-service IoT Edge GatewaysEUROTECH
These docs are for v7.2.0. Click to read the latest docs for v7.6.0.

SCEP Enrollment Service

Suggest Edits

SCEP is a PKI communication protocol which utilizes PKCS#7 and PKCS#10 messages that are sent over Hypertext Transfer Protocol (HTTP).
It is the most widely deployed protocol for certificate requests and CRL queries. However, the protocol does not support certain certificate management features such as in-band certificate revocation transactions.
To support more comprehensive functionality the IETF protocol suite provides two other certificate
management protocols – CMP and CMC.
SCEP is not a formal standard or RFC; it is a draft which has already expired and has been published as
historic. The protocol supports operations such as public key distribution through CA and RA, certificate enrollment, certificate query and CRLquery.

Its main characteristics are:

  • Request/response model based on HTTP (GET method; optional support for POST method)
  • Only supports RSA-based cryptography
  • Uses PKCS#10 as the certificate request format
  • Uses PKCS#7 in order to convey cryptographically signed/encrypted messages
  • Supports asynchronous granting by the server, with regular polling by the requester
  • Has limited Certificate Revocation List (CRL) retrieval support (the preferred method is through a CRL Distribution Point (CDP) query, for scalability reasons)
  • Does not support online certificate revocation (must be done offline through other means)
  • Requires the use of a challenge password field within the Certificate Signing Request (CSR), which must be shared only between the server and the requester

SCEP is described in the RFC 8894

The service download the CA certificates storing them in the selected KeystoreService with the alias prefix scep-cacerts_.
The generated private KeyPair will be stored in the selected KeystoreService with the alias sce-request-key-pair.
The signed certificate received from the SCEP server will be stored in the KeystoreService with the alias scep-enrolled-key-pair.

1568

The SCEPEnrollmentService component can be configured with the following attributes:

  • KeystoreService Target Filter:Specifies, as an OSGi target filter, the pid of the KeystoreService used to store keypairs and certificates.

  • Enabled:Enables the SCEPEnrollmentService.

  • SCEP server endpoint:Specifies the SCEP server endpoint (in the protocol:hostname:port format e.g: http://scep-server-endpoint:8999).[1]

  • CA root certificate verification method.:SCEP client can use a provided CA Root Certificate or download it from the server and verify with a fingerprint.

  • CA root certificate:CA certificate in PEM format used as Implicit Trust Anchor in the bootstrap procedure. It will be loaded from KeystoreService afterwards.[1]

  • CA root certificate fingerprint:CA certificate sha256 fingerprint in hexadecimal form. The length must be 64 characters in lowercase and without : (for example: cf93ee54a9c5c590b62e680d8aaa78d436a936b9750ed100c7aab045810a73f0).[1]

  • CA certificate rollover:Enable automatic CA certificate rollover. By default the check on certificate velidity is done every 24 hours.

  • Certificate expiration check time: In the case of client certificate a renew attempt will be made . In the case of CA certificates an update attempt will be made according with the protocol.

  • Connect Retry-interval:Specifies the time interval between two attempts in the enrollment process..

  • Challenge Password:Shared secret between client and server used to authenticate the certificate request signing..

  • Client Certificate renew:Enable automatic client certificate renew. By default the check on certificate validity is done every 24 hours.

  • Subject Distinguished Name (DN):Distinguished Name (DN) to be used as Subject in the CSR.

  • RSA key length:RSA key length (e.g. 1024, 2048 or 4096). By defaul 2048 bits.

[1] A change in this property triggers a new client bootstrap with a subsequent enrollment

Updated over 2 years ago