Device > Certificate Management > SCEP
The simple certificate enrollment protocol (SCEP) provides a mechanism for issuing a unique certificate to endpoints, gateways, and satellite devices. Select
to create an SCEP configuration.
To start a new SCEP configuration, click
Addand then complete the following fields.
Specify a descriptive Name to identify this SCEP configuration, such as SCEP_
Example. This name distinguishes a SCEP profile from other instances that you might have among the configuration profiles.
Select a Location for the profile if the system has multiple virtual systems. The location identifies where the SCEP configuration is available.
One Time Password (Challenge)
Optional) To make SCEP-based certificate generation more secure, you can configure a SCEP challenge-response mechanism (a one-time password (OTP)) between the public key infrastructure (PKI) and the portal for each certificate request.
After you configure this mechanism, its operation is invisible, and no further input from you is necessary.
The challenge mechanism that you select determines the source of the OTP. If you select
Fixed, copy the enrollment challenge password from the SCEP server for the PKI and enter the string in the portal’s
Passworddialog that displays when configured as
Fixed. Each time the portal requests a certificate, it uses this password to authenticate with the PKI. If you select
Dynamic, you enter the username and password of your choice (possibly the credentials of the PKI administrator) and the SCEP
Server URLwhere the portal-client submits these credentials. This username and password remains the same while the SCEP server transparently generates an OTP password for the portal upon each certificate request. (You can see this OTP change after a screen refresh in “The enrollment challenge password is” field upon each certificate request.) The PKI transparently passes each new password to the portal, which then uses the password for its certificate request.
To comply with the U.S. Federal Information Processing Standard (FIPS), select
Dynamic, specify a
Server URLthat uses HTTPS, and enable
SCEP Server SSL Authentication. (FIPS-CC operation is indicated on the firewall login page and in the firewall status bar.)
Enter the URL at which the portal requests and receives client certificates from the SCEP server. Example:
Enter a string to identify the SCEP server. Maximum length is 255 characters.
Configure the Subject to include identifying information about the device and optionally user and provide this information in the certificate signing request (CSR) to the SCEP server.
When used to request client certificates for endpoints, the endpoint sends identifying information about the device that includes its host ID value. The host ID value varies by device type, either GUID (Windows) MAC address of the interface (Mac), Android ID (Android devices), UDID (iOS devices), or a unique name that GlobalProtect assigns (Chrome). When used to request certificates for satellite devices, the host ID value is the device serial number.
To specify additional information in the CSR, enter the Subject name. The subject must be a distinguished name in the
<attribute>=<value>format and must include the common name (CN) key. For example:
There are two ways to specify the CN:
Subject Alternative Name Type
After you select a type other than
None, a dialog displays for you to enter the appropriate value:
Use as digital signature
Select this option to configure the endpoint to use the private key in the certificate to validate a digital signature.
Use for key encipherment
Select this option to configure the client endpoint to use the private key in the certificate to encrypt data exchanged over the HTTPS connection established with the certificates issued by the SCEP server.
CA Certificate Fingerprint
Optional) To ensure that the portal connects to the correct SCEP server, enter the
CA Certificate Fingerprint. Obtain this fingerprint from the SCEP server interface in the
Log in to the SCEP server’s administrative user interface (for example, at http://<hostname or IP>/CertSrv/mscep_admin/). Copy the thumbprint and enter it in
CA Certificate Fingerprint.
SCEP Server SSL Authentication
To enable SSL, select the root
CA Certificatefor the SCEP server. Optionally, you can enable mutual SSL authentication between the SCEP server and the GlobalProtect portal by selecting a