Configure a Simple Certificate Enrollment Protocol client

WARNING! The Simple Certificate Enrollment Protocol (SCEP) uses unencrypted HTTP communication. Please ensure you are utilizing a VPN to secure your communications.

Simple Certificate Enrollment Protocol (SCEP) is a mechanism that allows for large-scale X.509 certificate deployment. You can configure IX20 device to function as a SCEP client that will connect to a SCEP server that is used to sign Certificate Signing Requests (CSRs), provide Certificate Revocation Lists (CRLs), and distribute valid certificates from a Certificate Authority (CA).

Click a dropdown to see the configuration items for this procedure.

  • Enable the SCEP client.
  • The fully-qualified domain name of the SCEP server to be used for certificate requests.
  • The challenge password provided by the SCEP server that the SCEP client will use when making SCEP requests.
  • The distinguished name to be used for the CSR.
  • The number of days that the certificate enrollment can be renewed, prior to the request expiring.

To configure a SCEP client:

  1. Choose the management interface you want to use to access your device. Click a dropdown for instructions.

    1. Log in to Digi Remote Manager.

    1. Navigate to the device's dashboard.

    1. Log in to your device's Web UI.

    Log in to your device's Admin CLI via an SSH client, Telnet client, or terminal emulator.

  2. Configure the settings.

    1. Click Network > SCEP Client.
    2. For Add clients, enter a name for the SCEP client and click .

      The new SCEP client configuration is displayed.

    3. Click Enable to enable the SCEP client.
    4. For Maximum Polling Time, type the maximum time that the device will poll the SCEP server, when operating in manual mode.

      Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.

      For example, to set Maximum Polling Time to ten minutes, enter 10m or 600s.

      The default is 1d.

    5. For Polling Interval, type the amount of time that the device should wait between polling attempts, when operating in manual mode.

      Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.

      For example, to set Polling Interval to ten minutes, enter 10m or 600s.

      The default is 5s.

    6. For Key Length, type the bit size of the private key. The default is 2048.
    7. For Renewable Time, type the number of days that the certificate enrollment can be renewed, prior to the request expiring. This value is configured on the SCEP server, and is used by the IX20 device to determine when to start attempting to auto-renew an existing certificate. The default is 7.
    8. (Optional) Click Debug to enable verbose logging in /var/log/scep_client.
    9. Click to expand SCEP server.

    10. For FQDN, type the fully qualified domain name or IP address of the SCEP server.
    11. (Optional) For CA identity, type a string that will be understood by the certificate authority. For example, it could be a domain name or a user name. If the certificate authority has multiple CA certificates, this field can be used to distinguish which is required.
    12. For Path, Type the HTTP URL path required for accessing the certificate authority. You should leave this option at the default of /cgi-bin/pkiclient.exe unless directed by the CA to use another path.
    13. For Password, type the challenge password as configured on the SCEP server.

    14. For Encryption Algorithm, select the PKCS#7 encryption algorithm. The default is Auto, which automatically selects the best algorithm.

    15. For Signature Algorithm, select the PKCS#7 signature algorithm. The default is Auto, which automatically selects the best algorithm.

    16. Click to expand Distinguished Name.

    17. Type the value for each appropriate Distinguished Name attribute.
    18. (Optional) Configure the certificate revocation list (CRL):
      1. Click to expand CRL.
      2. Click Enable to enable the CRL.
      3. For Type, select the type of CRL:

        • URL: The URL to the file name used to access the certificate revocation list from the CA.

        • CRLDP: The CRL distribution point.

        • getCRL: A CRL query using the issuer name and serial number from the certificate whose revocation status is being queried.

        The default is URL.

      4. If Type is set to URL, for URL, type the URL to be used.

    19. Configure certificate renewal:

      1. Click to expand Renewal.

      2. Click Use New Private Key to enable the creation of a new private key for renewal requests.

      3. Use Client Certificate is enabled by default. Click to disable the use of a client certificate for renewal requrests.

    20. Click Apply to save the configuration and apply the change.
    1. Add a new SCEP client:
      (config)> add network scep_client scep_client_name
(config network scep_client scep_client_name
)>
    2. Enable the SCEP client:
      (config network scep_client scep_client_name)> enable true
(config network scep_client scep_client_name)>
    3. Set the url parameter to the fully qualified domain name or IP address of the SCEP server:
      (config network scep_client scep_client_name)> server url https://scep.example.com
(config network scep_client scep_client_name)>
    4. (Optional) Set a CA identity string that will be understood by the certificate authority. For example, it could be a domain name or a user name. If the certificate authority has multiple CA certificates, this field can be used to distinguish which is required.
      (config network scep_client scep_client_name)> server ca_ident string
(config network scep_client scep_client_name)>
    5. Set the HTTP URL path required for accessing the certificate authority. You should leave this option at the default of /cgi-bin/pkiclient.exe unless directed by the CA to use another path.
      (config network scep_client scep_client_name)> server path path
(config network scep_client scep_client_name)>
    6. Set the challenge password as configured on the SCEP server: 
      7. (config network scep_client scep_client_name)> server password challenge_password
(config network scep_client scep_client_name)>
    7. Set Distinguished Name attributes:

      1. Set the Domain Component:

        (config network scep_client scep_client_name)> distinguished_name dc value
(config network scep_client scep_client_name)>

      2. Set the two letter Country Code:

        (config network scep_client scep_client_name)> distinguished_name c value
(config network scep_client scep_client_name)>

      3. Set the State or Province:

        (config network scep_client scep_client_name)> distinguished_name st value
(config network scep_clientscep_client_name )>

      4. Set the Locality:

        (config network scep_client scep_client_name)> distinguished_name l value
(config network scep_client scep_client_name)>

      5. Set the Organization:

        (config network scep_client scep_client_name)> distinguished_name o value
(config network scep_client scep_client_name)>

      6. Set the Organizational Unit:

        (config network scep_client scep_client_name)> distinguished_name ou value
(config network scep_client scep_client_name)>

      7. Set the Common Name:

        (config network scep_client scep_client_name)> distinguished_name cn value
(config network scep_client scep_client_name)>
    8. (Optional) Configure the certificate revocation list (CRL):
      1. Enable the CRL:
        (config network scep_client scep_client_name)> crl enable true
(config network scep_client scep_client_name)>
      2. Set the type of CRL:
        (config network scep_client scep_client_name)> crl type value
(config network scep_client scep_client_name)>

        where value is one of:

        • url: The URL to the file name used to access the certificate revocation list from the CA.

        • crldp: The CRL distribution point.

        • getCRL: A CRL query using the issuer name and serial number from the certificate whose revocation status is being queried.

        The default is url.

      3. If type is set to url, set the URL that should be used:
        (config network scep_client scep_client_name)> crl url value
(config network scep_client scep_client_name)>

    9. Configure certificate renewal:

      1. To enable the creation of a new private key for renewal requests:
        (config network scep_client scep_client_name)> renewal new_key true
(config network scep_client scep_client_name)>

      2. The use of a client certificate for renewal requests is enabled by default. To disable:

        (config network scep_client scep_client_name)> renewal use_client_cert false
(config network scep_client scep_client_name)>

    10. Set the maximum time that the device will poll the SCEP server, when operating in manual mode:
      (config network scep_client scep_client_name)> max_poll_time value
(config network scep_client scep_client_name)>

      where value is any number of weeks, days, hours, minutes, or seconds, and takes the format number{w|d|h|m|s}.

      For example, to set max_poll_time to ten minutes, enter either 10m or 600s:

      (config network scep_client scep_client_name)> max_poll_time 600s
(config network scep_client scep_client_name)>

      The default is 1d.

    11. Set the amount of time that the device should wait between polling attempts, when operating in manual mode:
      (config network scep_client scep_client_name)> polling_interval value
(config network scep_client scep_client_name)>

      where value is any number of weeks, days, hours, minutes, or seconds, and takes the format number{w|d|h|m|s}.

      For example, to set polling_interval to ten minutes, enter either 10m or 600s:

      (config network scep_client scep_client_name)> polling_interval 600s
(config network scep_client scep_client_name)>

      The default is 5s.

    12. Set the bit size of the private key:
      (config network scep_client scep_client_name)> key_length int
(config network scep_client scep_client_name)>

      The default is 2048.

    13. Set the number of days that the certificate enrollment can be renewed, prior to the request expiring. This value is configured on the SCEP server, and is used by the IX20 device to determine when to start attempting to auto-renew an existing certificate. The default is 7.

      (config network scep_client scep_client_name)> renewable_time integer
(config network scep_client scep_client_name)>
    14. (Optional) Enable verbose logging in /var/log/scep_client:
      (config network scep_client scep_client_name)> debug true
(config network scep_client scep_client_name)>
    15. Save the configuration and apply the change.
      (config network scep_client scep_client_name)> save
Configuration saved.
>
    16. Type exit to exit the Admin CLI.

      Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.