Device > Certificate Management > SCEP
The simple certificate enrollment protocol (SCEP) provides a mechanism for issuing a unique certificate to endpoints, gateways, and satellite devices. Select DeviceCertificate ManagementSCEP to create an SCEP configuration.
For more information on how to create a SCEP profile, refer to Deploying Certificates Using SCEP.
To start a new SCEP configuration, click Add and then complete the following fields.
Specify a descriptive Name to identify this SCEP configuration, such as SCEP_Example. This name distinguishes a SCEP profile from other instances that you might have among the configuration profiles.
Select a Location for the profile if the system has multiple virtual systems. The location identifies where the SCEP configuration is available.
One Time Password (Challenge)
(Optional) To make SCEP-based certificate generation more secure, you can configure a SCEP challenge-response mechanism (a one-time password (OTP)) between the public key infrastructure (PKI) and the portal for each certificate request.
After you configure this mechanism, its operation is invisible, and no further input from you is necessary.
The challenge mechanism that you select determines the source of the OTP. If you select Fixed, copy the enrollment challenge password from the SCEP server for the PKI and enter the string in the portal’s Password dialog that displays when configured as Fixed. Each time the portal requests a certificate, it uses this password to authenticate with the PKI. If you select Dynamic, you enter the username and password of your choice (possibly the credentials of the PKI administrator) and the SCEP Server URL where the portal-client submits these credentials. This username and password remains the same while the SCEP server transparently generates an OTP password for the portal upon each certificate request. (You can see this OTP change after a screen refresh in “The enrollment challenge password is” field upon each certificate request.) The PKI transparently passes each new password to the portal, which then uses the password for its certificate request.
To comply with the U.S. Federal Information Processing Standard (FIPS), select Dynamic, specify a Server URL that uses HTTPS, and enable SCEP Server SSL Authentication. (FIPS-CC operation is indicated on the firewall login page and in the firewall status bar.)
Enter the URL at which the portal requests and receives client certificates from the SCEP server. Example:
http://<hostname or IP>/certsrv/mscep/.
Code copied to clipboard
Unable to copy due to lack of browser support.
Enter a string to identify the SCEP server. Maximum length is 255 characters.
Configure the Subject to include identifying information about the device and optionally user and provide this information in the certificate signing request (CSR) to the SCEP server.
When used to request client certificates for endpoints, the endpoint sends identifying information about the device that includes its host ID value. The host ID value varies by device type, either GUID (Windows) MAC address of the interface (Mac), Android ID (Android devices), UDID (iOS devices), or a unique name that GlobalProtect assigns (Chrome). When used to request certificates for satellite devices, the host ID value is the device serial number.
To specify additional information in the CSR, enter the Subject name. The subject must be a distinguished name in the <attribute>=<value> format and must include the common name (CN) key. For example:
There are two ways to specify the CN:
Subject Alternative Name Type
After you select a type other than None, a dialog displays for you to enter the appropriate value:
Use as digital signature
Select this option to configure the endpoint to use the private key in the certificate to validate a digital signature.
Use for key encipherment
Select this option to configure the client endpoint to use the private key in the certificate to encrypt data exchanged over the HTTPS connection established with the certificates issued by the SCEP server.
CA Certificate Fingerprint
(Optional) To ensure that the portal connects to the correct SCEP server, enter the CA Certificate Fingerprint. Obtain this fingerprint from the SCEP server interface in the Thumbprint field.
Log in to the SCEP server’s administrative user interface (for example, at http://<hostname or IP>/CertSrv/mscep_admin/). Copy the thumbprint and enter it in CA Certificate Fingerprint.
SCEP Server SSL Authentication
To enable SSL, select the root CA Certificate for the SCEP server. Optionally, you can enable mutual SSL authentication between the SCEP server and the GlobalProtect portal by selecting a Client Certificate.
Deploy Client Certificates to the GlobalProtect Satellites ...
Deploy Client Certificates to the GlobalProtect Satellites Using SCEP As an alternative method for deploying client certificates to satellites, you can configure your GlobalProtect portal ...
Deploy Server Certificates to the GlobalProtect Components
Deploy Server Certificates to the GlobalProtect Components The following table shows the best practice steps for deploying SSL/TLS certificates to the GlobalProtect components: Import a ...
Deploy Certificates Using SCEP
Deploy Certificates Using SCEP If you have a Simple Certificate Enrollment Protocol (SCEP) server in your enterprise PKI, you can configure a SCEP profile to ...
Deploy User-Specific Client Certificates for Authentication
Deploy User-Specific Client Certificates for Authentication To authenticate individual users, you must issue a unique client certificate to each GlobalProtect user and deploy the client ...
Change a Client Certificate
Change a Client Certificate Complete the following task to replace a client certificate. Obtain or generate the device certificate. You can deploy certificates on Panorama ...
Manage Firewall and Panorama Certificates
Manage Firewall and Panorama Certificates Device > Certificate Management > Certificates > Device Certificates Panorama > Certificate Management > Certificates Select Device Certificate Management Certificates ...
Communication Settings Panorama > Managed Collectors > Communication To configure custom certificate-based authentication between Log Collectors and Panorama, firewalls, and other Log Collectors, configure the ...
Enable Two-Factor Authentication Using Certificate and Auth...
Enable Two-Factor Authentication Using Certificate and Authentication Profiles The following workflow describes how to configure GlobalProtect to require users to authenticate to both a certificate ...
GlobalProtect Certificate Best Practices
GlobalProtect Certificate Best Practices The following table summarizes the SSL/TLS certificates you will need, depending on which features you plan to use: Certificate Usage Issuing ...