SCEP Server in IGEL OS 12

HTTPS is not supported; however, all security-critical data that are transferred between the SCEP client and other components are encrypted.

Microsoft NDES Server Settings

By default, the password on a Microsoft NDES server is valid for 1 hour and can be used only once. In order to use the password on numerous devices, additional settings must be made on the NDES server. For information, see the section "Password and Password Cache" on https://social.technet.microsoft.com.

On a Microsoft NDES server, you can retrieve the password under https://<HOSTNAME>/certsrv/mscep_admin

Automatic Password Retrieval (NDES only)

When automatic retrieval is enabled, the device extracts the NDES challenge password from the NDES server (https://<HOSTNAME>/certsrv/mscep_admin).

To enable automatic retrieval of the NDES password, make the following settings in System > Registry:

• Set network.scepclient.cert%.use_ready_made_challenge_password_command to NDES.

• Set network.scepclient.cert%.ndes.challenge_password_retrieval.user to the username with which the NDES challenge password can be retrieved from the NDES server (https://<HOSTNAME>/certsrv/mscep_admin).

• Set network.scepclient.cert%.ndes.challenge_password_retrieval.crypt_password to the password with which the NDES challenge password can be retrieved from the NDES server (https://<HOSTNAME>/certsrv/mscep_admin).

• If you want HTTPS to be used, you have two options:

  • Set network.scepclient.cert%.ndes.challenge_password_retrieval.cacert to from getca operation.

  • Enter the appropriate certificate under network.scepclient.cert%.ndes.challenge_password_retrieval.cacert

• If you want to use unsecured HTTP, set network.scepclient.cert%.ndes.challenge_password_retrieval.cacert to none (not using https).

• If you want to use Kerberos instead of the Default method NTLM, set network.scepclient.cert%.ndes.challenge_password_retrieval.auth to Kerberos. Please note that for Kerberos authentication, Security > Active Directory/Kerberos must be enabled, and the domain must be configured there.

As an example, a certificate is valid until 31.12. of a year. If the period for renewal is set to 10 days, a new certificate will be requested for the first time on 21.12. of the same year.