|
SCEP Setting |
Description |
|
Name
|
Specify a descriptive Name to identify this SCEP configuration, such as SCEP_Example. This name distinguishes a SCEP profile from other instances that you might have among the configuration profiles.
|
|
Location
|
Select a Location for the profile if the system has multiple virtual systems. The location identifies where the SCEP configuration is available.
|
|
One Time Password (Challenge)
|
|
SCEP Challenge
|
(Optional) To make SCEP-based certificate generation more secure, you can configure a SCEP challenge-response mechanism (a one-time password (OTP)) between the public key infrastructure (PKI) and the portal for each certificate request.
After you configure this mechanism, its operation is invisible, and no further input from you is necessary.
The challenge mechanism that you select determines the source of the OTP. If you select
Fixed, you copy the enrollment challenge password from the PKI’s SCEP server and enter the string in the portal’s
Password
dialog that displays when configured as
Fixed. Each time the portal requests a certificate, it uses this password to authenticate with the PKI. If you select
Dynamic, you enter the username and password of your choice (possibly the credentials of the PKI administrator) and the SCEP
Server URL
where the portal-client submits these credentials. This username and password remains the same while the SCEP server transparently generates an OTP password for the portal upon each certificate request. (You can see this OTP change after a screen refresh in “The enrollment challenge password is” field upon each certificate request.) The PKI transparently passes each new password to the portal, which then uses the password for its certificate request.
To comply with the U.S. Federal Information Processing Standard (FIPS), select
Dynamic, specify a
Server URL
that uses HTTPS, and enable
SCEP Server SSL Authentication. (FIPS-CC operation is indicated on the firewall login page and in the firewall status bar.)
|
|
Configuration
|
|
Server URL
|
Enter the URL at which the portal requests and receives client certificates from the SCEP server. For example:
http://<hostname or IP>/certsrv/mscep/
|
|
CA-IDENT Name
|
Enter a string to identify the SCEP server. Maximum length is 255 characters.
|
|
Subject
|
Configure the Subject to include identifying information about the device and optionally user and provide this information in the certificate signing request (CSR) to the SCEP server.
When used to request client certificates for endpoints, the endpoint sends identifying information about the device that includes its host ID value. The host ID value varies by device type, either GUID (Windows) MAC address of the interface (Mac), Android ID (Android devices), UDID (iOS devices), or a unique name that GlobalProtect assigns (Chrome). When used to request certificates for satellite devices, the host ID value is the device serial number.
To specify additional information in the CSR, enter the Subject name. The subject must be a distinguished name in the
<attribute>=<value>
format and must include the common name (CN) key. For example:
O=acme,CN=acmescep
There are two ways to specify the CN:
Token-based CN
(Recommended)—Enter one of the supported tokens
$USERNAME, $EMAILADDRESS, or $HOSTID
. Use the username or email address variable to ensure that the portal requests certificates for a specific user. To request certificates for the device only, specify the hostid variable. When the GlobalProtect portal pushes the SCEP settings to the agent, the CN portion of the subject name is replaced with the actual value (username, hostid, or email address) of the certificate owner. For example:
O=acme,CN=$HOSTID
Static CN
—The CN you specify will be used as the subject for all certificates issued by the SCEP server. For example:
O=acme,CN=acmescep
|
|
Subject Alternative Name Type
|
After you select a type other than
None, a dialog displays for you to enter the appropriate value.
RFC 822 Name
—Enter the email name in a certificate’s subject or Subject Alternative Name extension.
DNS Name
—Enter the DNS name used to evaluate certificates.
Uniform Resource Identifier (URI)
—Enter the name of the URI resource from which the client obtains the certificate.
|
|
Cryptographic Settings
|
Number of Bits
—Select the key’s
Number of Bits
for the certificate. If the firewall is in FIPS-CC mode, the generated keys must be at least 2,048 bits. (FIPS-CC operation is indicated on the firewall login page and the firewall status bar.)
Digest
—Select the
Digest
algorithm for the certificate—
SHA1,
SHA256,
SHA384, or
SHA512. If the firewall is in FIPS-CC mode, you must select
SHA256,
SHA384, or
SHA512
as the
Digest
algorithm.
|
|
Use as digital signature
|
Select this option to configure the endpoint to use the private key in the certificate to validate a digital signature.
|
|
Use for key encipherment
|
Select this option to configure the client endpoint to use the private key in the certificate to encrypt data exchanged over the HTTPS connection established with the certificates issued by the SCEP server.
|
|
CA Certificate Fingerprint
|
(Optional) To ensure that the portal connects to the correct SCEP server, enter the
CA Certificate Fingerprint. Obtain this fingerprint from the SCEP server interface in the
Thumbprint
field.
Log in to the SCEP server’s administrative user interface (for example, at http://<hostname or IP>/CertSrv/mscep_admin/). Copy the thumbprint and enter it in
CA Certificate Fingerprint.
|
|
SCEP Server SSL Authentication
|
To enable SSL, select the SCEP server’s root
CA Certificate. Optionally, you can enable mutual SSL authentication between the SCEP server and the GlobalProtect portal by selecting a
Client Certificate.
|
