25.8. Using SCEP with certmonger

Procedure

1. Add the CA configuration to certmonger:

   [root@client.idm.example.com ~]# getcert add-scep-ca -c SCEP_example -u SCEP_URL

   • -c: Mandatory nickname for the CA configuration. The same value can later be used with other getcert commands.

   • -u: URL of the server’s SCEP interface.

     重要

     When using an HTTPS URL, you must also specify the location of the PEM-formatted copy of the SCEP server CA certificate using the -R option.

2. Verify that the CA configuration has been successfully added:

   [root@client.idm.example.com ~]# getcert list-cas -c SCEP_example
   CA 'SCEP_example':
          is-default: no
          ca-type: EXTERNAL
          helper-location: /usr/libexec/certmonger/scep-submit -u http://SCEP_server_enrollment_interface_URL
          SCEP CA certificate thumbprint (MD5): A67C2D4B 771AC186 FCCA654A 5E55AAF7
          SCEP CA certificate thumbprint (SHA1): FBFF096C 6455E8E9 BD55F4A5 5787C43F 1F512279

   If the configuration was successfully added, certmonger retrieves the CA chain from the remote CA. The CA chain then appears as thumbprints in the command output. When accessing the server over unencrypted HTTP, manually compare the thumbprints with the ones displayed at the SCEP server to prevent a man-in-the-middle attack.

3. Request a certificate from the CA:

   • If you are using NSS:

     [root@client.idm.example.com ~]# getcert request -I Example_Task -c SCEP_example -d /etc/pki/nssdb -n ExampleCert -N cn="client.idm.example.com" -L one-time_PIN -D client.idm.example.com

     You can use the options to specify the following parameters of the certificate request:

     • -I: Optional: Name of the task: the tracking ID for the request. The same value can later be used with the getcert list command.
     • -c: CA configuration to submit the request to.
     • -d: Directory with the NSS database to store the certificate and key.
     • -n: Nickname of the certificate, used in the NSS database.
     • -N: Subject name in the CSR.
     • -L: Time-limited one-time challengePassword PIN issued by the CA.
     • -D: Subject Alternative Name for the certificate, usually the same as the host name.

   • If you are using OpenSSL:

     [root@client.idm.example.com ~]# getcert request -I Example_Task -c SCEP_example -f /etc/pki/tls/certs/server.crt -k /etc/pki/tls/private/private.key -N cn="client.idm.example.com" -L one-time_PIN -D client.idm.example.com

     You can use the options to specify the following parameters of the certificate request:

     • -I: Optional: Name of the task: the tracking ID for the request. The same value can later be used with the getcert list command.
     • -c: CA configuration to submit the request to.
     • -f: Storage path to the certificate.
     • -k: Storage path to the key.
     • -N: Subject name in the CSR.
     • -L: Time-limited one-time challengePassword PIN issued by the CA.
     • -D: Subject Alternative Name for the certificate, usually the same as the host name.

Verification

1. Verify that a certificate was issued and correctly stored in the local database:

   • If you used NSS, enter:

     [root@client.idm.example.com ~]# getcert list -I Example_Task
     	Request ID 'Example_Task':
             status: MONITORING
             stuck: no
             key pair storage: type=NSSDB,location='/etc/pki/nssdb',nickname='ExampleCert',token='NSS Certificate DB'
             certificate: type=NSSDB,location='/etc/pki/nssdb',nickname='ExampleCert',token='NSS Certificate DB'
             signing request thumbprint (MD5): 503A8EDD DE2BE17E 5BAA3A57 D68C9C1B
             signing request thumbprint (SHA1): B411ECE4 D45B883A 75A6F14D 7E3037F1 D53625F4
             CA: IPA
             issuer: CN=Certificate Authority,O=EXAMPLE.COM
             subject: CN=client.idm.example.com,O=EXAMPLE.COM
             expires: 2018-05-06 10:28:06 UTC
             key usage: digitalSignature,keyEncipherment
             eku: iso.org.dod.internet.security.mechanisms.8.2.2
             certificate template/profile: IPSECIntermediateOffline
             pre-save command:
             post-save command:
             track: true
     	auto-renew: true

   • If you used OpenSSL, enter:

     [root@client.idm.example.com ~]# getcert list -I Example_Task
     Request ID 'Example_Task':
            status: MONITORING
            stuck: no
            key pair storage: type=FILE,location='/etc/pki/tls/private/private.key'
            certificate: type=FILE,location='/etc/pki/tls/certs/server.crt'
            CA: IPA
            issuer: CN=Certificate Authority,O=EXAMPLE.COM
            subject: CN=client.idm.example.com,O=EXAMPLE.COM
            expires: 2018-05-06 10:28:06 UTC
            eku: id-kp-serverAuth,id-kp-clientAuth
            pre-save command:
            post-save command:
            track: true
            auto-renew: true

     The status MONITORING signifies a successful retrieval of the issued certificate. The getcert-list(1) man page lists other possible states and their meanings.

Procedure

1. Open regedit on the AD server.
2. In the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP subkey, add a new 32-bit REG_DWORD entry DisableRenewalSubjectNameMatch and set its value to 1.

3. On the server where certmonger is running, open the /etc/certmonger/certmonger.conf file and add the following section:

   [scep]
   challenge_password_otp = yes

4. Restart certmonger:

   # systemctl restart certmonger