The simple certificate enrollment protocol (SCEP) provides a mechanism for issuing a unique certificate to endpoints, gateways, and satellite devices. Select
Device > Certificate Management > SCEP
to create an SCEP configuration.
To start a new SCEP configuration, click
and then complete the following fields.
Specify a descriptive Name to identify this SCEP configuration, such as SCEP_Example. This name distinguishes a SCEP profile from other instances that you might have among the configuration profiles.
Select a Location for the profile if the system has multiple virtual systems. The location identifies where the SCEP configuration is available.
One Time Password (Challenge)
(Optional) To make SCEP-based certificate generation more secure, you can configure a SCEP challenge-response mechanism (a one-time password (OTP)) between the public key infrastructure (PKI) and the portal for each certificate request.
After you configure this mechanism, its operation is invisible, and no further input from you is necessary.
The challenge mechanism that you select determines the source of the OTP. If you select
Fixed, you copy the enrollment challenge password from the PKI’s SCEP server and enter the string in the portal’s
dialog that displays when configured as
Fixed. Each time the portal requests a certificate, it uses this password to authenticate with the PKI. If you select
Dynamic, you enter the username and password of your choice (possibly the credentials of the PKI administrator) and the SCEP
where the portal-client submits these credentials. This username and password remains the same while the SCEP server transparently generates an OTP password for the portal upon each certificate request. (You can see this OTP change after a screen refresh in “The enrollment challenge password is” field upon each certificate request.) The PKI transparently passes each new password to the portal, which then uses the password for its certificate request.
To comply with the U.S. Federal Information Processing Standard (FIPS), select
Dynamic, specify a
that uses HTTPS, and enable
SCEP Server SSL Authentication. (FIPS-CC operation is indicated on the firewall login page and in the firewall status bar.)
Enter the URL at which the portal requests and receives client certificates from the SCEP server. For example:
http://<hostname or IP>/certsrv/mscep/
Enter a string to identify the SCEP server. Maximum length is 255 characters.
Configure the Subject to include identifying information about the device and optionally user and provide this information in the certificate signing request (CSR) to the SCEP server.
When used to request client certificates for endpoints, the endpoint sends identifying information about the device that includes its host ID value. The host ID value varies by device type, either GUID (Windows) MAC address of the interface (Mac), Android ID (Android devices), UDID (iOS devices), or a unique name that GlobalProtect assigns (Chrome). When used to request certificates for satellite devices, the host ID value is the device serial number.
To specify additional information in the CSR, enter the Subject name. The subject must be a distinguished name in the
format and must include the common name (CN) key. For example:
There are two ways to specify the CN:
(Recommended)—Enter one of the supported tokens
$USERNAME, $EMAILADDRESS, or $HOSTID. Use the username or email address variable to ensure that the portal requests certificates for a specific user. To request certificates for the device only, specify the hostid variable. When the GlobalProtect portal pushes the SCEP settings to the agent, the CN portion of the subject name is replaced with the actual value (username, hostid, or email address) of the certificate owner. For example:
—The CN you specify will be used as the subject for all certificates issued by the SCEP server. For example:
Subject Alternative Name Type
After you select a type other than
None, a dialog displays for you to enter the appropriate value.
RFC 822 Name
—Enter the email name in a certificate’s subject or Subject Alternative Name extension.
—Enter the DNS name used to evaluate certificates.
Uniform Resource Identifier (URI)
—Enter the name of the URI resource from which the client obtains the certificate.
Number of Bits
—Select the key’s
Number of Bits
for the certificate. If the firewall is in FIPS-CC mode, the generated keys must be at least 2,048 bits. (FIPS-CC operation is indicated on the firewall login page and the firewall status bar.)
algorithm for the certificate—
SHA512. If the firewall is in FIPS-CC mode, you must select
Use as digital signature
Select this option to configure the endpoint to use the private key in the certificate to validate a digital signature.
Use for key encipherment
Select this option to configure the client endpoint to use the private key in the certificate to encrypt data exchanged over the HTTPS connection established with the certificates issued by the SCEP server.
CA Certificate Fingerprint
(Optional) To ensure that the portal connects to the correct SCEP server, enter the
CA Certificate Fingerprint. Obtain this fingerprint from the SCEP server interface in the
Log in to the SCEP server’s administrative user interface (for example, at http://<hostname or IP>/CertSrv/mscep_admin/). Copy the thumbprint and enter it in
CA Certificate Fingerprint.
SCEP Server SSL Authentication
To enable SSL, select the SCEP server’s root
CA Certificate. Optionally, you can enable mutual SSL authentication between the SCEP server and the GlobalProtect portal by selecting a
Enhanced Two-Factor Authentication Two-factor authentication enables strong authentication by using a pre-deployed client certificate or a dynamic password, such as one-time password (OTP), and supports ...
GlobalProtect Certificate Best Practices
GlobalProtect Certificate Best Practices The following table summarizes the SSL/TLS certificates you will need, depending on which features you plan to use: GlobalProtect Certificate Requirements ...
Enable Two-Factor Authentication Using Certificate and Auth...
Enable Two-Factor Authentication Using Certificate and Authentication Profiles The following workflow describes how to configure GlobalProtect client authentication requiring the user to authenticate both to ...
Generate a Certificate
Generate a Certificate Palo Alto Networks firewalls and Panorama use certificates to authenticate clients, servers, users, and devices in several applications, including SSL/TLS decryption, Captive ...
GlobalProtect Features New GlobalProtect Feature Description GlobalProtect App for Chrome OS The new GlobalProtect app for Chrome OS is now available for Chromebooks running Chrome ...
Network > GlobalProtect > Portals
Network > GlobalProtect > Portals Select Network > GlobalProtect > Portals to set up and manage a GlobalProtect™ portal. The portal provides the management functions ...