Device > Certificate Management > SCEP
The simple certificate enrollment protocol (SCEP) provides
a mechanism for issuing a unique certificate to endpoints, gateways,
and satellite devices. Select to
create an SCEP configuration.
Device
Certificate Management
SCEP
For more information on how to create a SCEP profile, refer
to Deploying Certificates Using SCEP
To start a new SCEP configuration, click
Add
and
then complete the following fields.SCEP Settings | Description |
|---|---|
Name | Specify a descriptive Name to identify this
SCEP configuration, such as SCEP_ Example . This name
distinguishes a SCEP profile from other instances that you might
have among the configuration profiles. |
Location | Select a Location for the profile if the
system has multiple virtual systems. The location identifies where
the SCEP configuration is available. |
One Time Password (Challenge) | |
SCEP Challenge | ( Optional ) To make SCEP-based certificate
generation more secure, you can configure a SCEP challenge-response
mechanism (a one-time password (OTP)) between the public key infrastructure
(PKI) and the portal for each certificate request.After
you configure this mechanism, its operation is invisible, and no
further input from you is necessary. The challenge
mechanism that you select determines the source of the OTP. If you
select Fixed , copy the enrollment challenge password
from the SCEP server for the PKI and enter the string in the portal’s Password dialog
that displays when configured as Fixed . Each
time the portal requests a certificate, it uses this password to
authenticate with the PKI. If you select Dynamic ,
you enter the username and password of your choice (possibly the credentials
of the PKI administrator) and the SCEP Server URL where
the portal-client submits these credentials. This username and password
remains the same while the SCEP server transparently generates an
OTP password for the portal upon each certificate request. (You
can see this OTP change after a screen refresh in “The enrollment
challenge password is” field upon each certificate request.) The
PKI transparently passes each new password to the portal, which
then uses the password for its certificate request.To
comply with the U.S. Federal Information Processing Standard (FIPS),
select Dynamic , specify a Server
URL that uses HTTPS, and enable SCEP Server
SSL Authentication . (FIPS-CC operation is indicated
on the firewall login page and in the firewall status bar.) |
Configuration | |
Server URL | Enter the URL at which the portal requests
and receives client certificates from the SCEP server. Example:
|
CA-IDENT Name | Enter a string to identify the SCEP server.
Maximum length is 255 characters. |
Subject | Configure the Subject to include identifying
information about the device and optionally user and provide this
information in the certificate signing request (CSR) to the SCEP
server. When used to request client certificates for endpoints,
the endpoint sends identifying information about the device that includes
its host ID value. The host ID value varies by device type, either
GUID (Windows) MAC address of the interface (Mac), Android ID (Android
devices), UDID (iOS devices), or a unique name that GlobalProtect
assigns (Chrome). When used to request certificates for satellite
devices, the host ID value is the device serial number. To
specify additional information in the CSR, enter the Subject name.
The subject must be a distinguished name in the <attribute>=<value> format
and must include the common name (CN) key. For example:
There are
two ways to specify the CN:
|
Subject Alternative Name Type | After you select a type other than None ,
a dialog displays for you to enter the appropriate value:
|
Cryptographic Settings |
|
Use as digital signature | Select this option to configure the endpoint
to use the private key in the certificate to validate a digital
signature. |
Use for key encipherment | Select this option to configure the client
endpoint to use the private key in the certificate to encrypt data
exchanged over the HTTPS connection established with the certificates
issued by the SCEP server. |
CA Certificate Fingerprint | ( Optional ) To ensure that the portal
connects to the correct SCEP server, enter the CA Certificate
Fingerprint . Obtain this fingerprint from the SCEP server
interface in the Thumbprint field.Log
in to the SCEP server’s administrative user interface (for example,
at http://<hostname or IP>/CertSrv/mscep_admin/). Copy the thumbprint
and enter it in CA Certificate Fingerprint . |
SCEP Server SSL Authentication | To enable SSL, select the root CA
Certificate for the SCEP server. Optionally, you can
enable mutual SSL authentication between the SCEP server and the
GlobalProtect portal by selecting a Client Certificate . |
Recommended For You
Recommended Videos
Recommended videos not found.
