SCEP enrollment

SCEP (Simple Certificate Enrollment Protocol, RFC 8894) lets routers, switches and firewalls that do not speak EST request and renew certificates from a Taranac Internal CA: classic Cisco IOS, MikroTik RouterOS and others whose built-in enrollment client is SCEP. The device generates its key, sends a certificate signing request (CSR) encrypted inside a SCEP message, and receives the signed certificate in the reply.

SCEP is configured on its own card on NAC → Settings → PKI Settings, next to EST. It has its own switch, CA, validity, approval and networks, and reads nothing from the EST card. Turn on only EST, only SCEP, or both with different values.

SCEP is served by the est-gateway container, the same one that serves EST, on every node. Devices get:

http://<taranac-address>:8446/scep

Plain HTTP, on purpose. The SCEP clients of Cisco IOS and MikroTik RouterOS cannot do HTTPS: given an https:// URL, IOS-XE stops speaking SCEP and asks for files instead, and RouterOS refuses the URL. SCEP does not need TLS for secrecy: the request is encrypted to Taranac’s RA certificate, and the challenge password travels inside it. The plain-HTTP port serves the SCEP paths only. EST is never served over HTTP, because its password is sent as HTTP Basic.

• Port. 8446 is the default of SCEP_HTTP_PORT in .env.
• Over HTTPS. The gateway’s HTTPS port (8445, EST_GATEWAY_PORT) serves SCEP too, at https://<taranac-address>:8445/scep, for clients that can do TLS.
• Path aliases. Clients rewrite the URL they are given. Cisco IOS appends /pkiclient.exe to it (/scep/pkiclient.exe), and a client given no path asks for /cgi-bin/pkiclient.exe. Both are served on both ports.
• The host is taken the same way as for EST: the host of Public base URL, else TARANAC_DOMAIN, else the first TARANAC_NODE_IPS address (see the device enrollment URL).

Device enrollment URL (SCEP) on the SCEP card shows the URL with a Copy URL button and, marked ENV, where the host and the port came from.

1. Have an Internal CA to issue from. Create one on NAC → Settings → PKI / Certificates (see PKI & trust), or run one under your corporate root (see Taranac under your corporate root). It may be the same CA EST uses, or another.
2. Choose the SCEP CA on the SCEP card. Enable SCEP endpoint stays disabled until a CA is chosen (its tooltip reads Choose the SCEP CA first).
3. Set the policy: validity, approval, the networks for IP SANs and the source networks. Every field is editable while SCEP is off.
4. Open the port from the devices to every node they enroll with: 8446 (TCP). See Ports and firewall.
5. Switch on Enable SCEP endpoint. The first time, this generates the challenge password.
6. Configure the device with the device URL and the challenge password. See Device examples.

All on NAC → Settings → PKI Settings → SCEP Enrollment. Every field is editable whether SCEP is on or off. Approval group, Request lifetime and Approval link lifetime are editable while Require admin approval is on.

The SCEP CA is listed under Used by on the CA’s form, and a CA in use cannot be deleted (see CA status and lifecycle). For a CA signed by your corporate PKI, GetCACert carries the chain up to the corporate root (see what Taranac does with the chain).

Devices prove they may enroll with one shared challenge password. Taranac generates it when SCEP is switched on for the first time: 40 hexadecimal characters, which any device CLI takes without quotes or escaping. It is stored encrypted, and you cannot set it yourself.

• Show and Copy read it. They need PKI edit rights (nac_pki.edit), not just view rights, because whoever reads it can have certificates issued. Each read is written to the Activity Log (NAC_SETTINGS_SECRET_REVEALED).
• Regenerate replaces it after a confirmation (NAC_PKI_SCEP_CHALLENGE_REGENERATED). The old one stops working at once: devices configured with it cannot make a first enrollment until they get the new one. Renewals are not affected.
• Switching SCEP off and on again keeps the same password.

Anyone who learns the challenge can request a device certificate. Turn on Require admin approval, limit Networks devices may request certificates from, or both.

A device that presents the challenge gets a certificate exactly like an EST Device account:

• Subject: the CSR’s subject, CN kept.
• SAN: the DNS names and IP addresses from the CSR. At least one is required. Each is copied once, and DNS names are not validated. No UPN or email entry is copied.
• IP SANs must fall inside Allowed networks for IP SANs when the list is set, or the request is refused with a message naming the address.
• Stored as a device certificate, named SCEP: <CN> in the issued certificates, with Source SCEP (a renewal: SCEP renewal).

The client’s RSA key must be at least 2048 bits.

Renewal needs no password. The device signs its renewal request with its current certificate, and Taranac applies the same checks as an EST renewal: the certificate is one this Taranac issued, byte for byte; it is active and not past its end date; the CA that issued it can still issue; and the CSR keeps the same subject. The renewed certificate stays a device certificate.

• Names kept. A renewal request that names no DNS names or IP addresses gets those of the certificate it renews. A request that names something gets its own names. Inherited IP addresses are checked against Allowed networks for IP SANs again.
• Which message is which. A request that carries the challenge is a first enrollment, even when it is signed by a certificate of ours. A request without the challenge, signed by a certificate of ours, is a renewal. A request without the challenge signed by anything else is refused (challenge_missing).
• No renewal window. A certificate renews at any time while it is valid. An expired or revoked one enrolls again with the challenge.
• Renewal does not revoke the certificate it replaces.

Across protocols. A certificate issued over EST renews over SCEP, and the reverse. The renewal follows the settings of the protocol it arrives by: a renewal over SCEP is issued by the SCEP CA under SCEP’s validity, approval and networks. With approval on SCEP only, a device renewing over EST is not held for approval. Turn approval on for both protocols if every renewal must be reviewed.

SCEP encrypts each request to an RSA certificate with keyEncipherment, which a CA certificate does not carry. Taranac therefore has the SCEP CA sign an RA certificate (RSA 2048) and hands it out with the CA chain in GetCACert. Nothing needs configuring:

• It is issued on first need, by GetCACert or a request.
• It is replaced when it has less than 60 days left, provided the new one outlives it (an RA certificate never outlives its CA). GetCACert always hands out the newest.
• Older RA certificates are kept until a month after they expire, so a device that fetched one before a rotation is still understood, and is answered with the one it knows.
• Each CA has its own RA certificate. After the SCEP CA changes, a device still waiting on a queued request is answered by the old CA’s RA certificate until the request is collected or its lifetime ends. A new request encrypted to the old CA’s RA certificate is refused: the device fetches GetCACert again.

Networks devices may request certificates from (CIDR, one per line) limits where SCEP requests may come from. Empty, the default, allows any address. When it is set, a SCEP request from any other address is refused with 403 before anything else is checked, GetCACaps and GetCACert included. EST has its own list on its own card.

Five wrong challenge passwords from one address within 15 minutes block that address from SCEP for 15 minutes. A missing challenge and a failed renewal do not count. A blocked address is refused on PKIOperation; GetCACaps and GetCACert still answer. The block leaves EST open for the same address, and EST’s own blocks leave SCEP open. As for EST, an IPv6 source is counted and blocked by its /64, each block raises a warning alert (Certificate enrollment blocked for <address> (SCEP)) and an Activity Log entry (NAC_PKI_ENROLLMENT_SOURCE_BLOCKED), and Blocked addresses on the SCEP card lists it with Unblock. See the enrollment guard.

PKIOperation allows 10 requests a minute per client address.

With Require admin approval on, a request waits for a person. The device is answered pending and polls (CertPoll) until the decision: approved, it collects the certificate; rejected, it gets a failure and stops. A device that sends the request again with a new transaction ID continues on that one. An expired request that is still being polled goes back to pending.

SCEP requests sit in the same Enrollment requests queue on the PKI page as EST requests, with SCEP in the Protocol column, and can be filtered by protocol. They are SCEP’s own:

• Members of the SCEP Approval group get a SCEP enrollment awaiting approval email with one-time links, valid for SCEP’s Approval link lifetime. The page a link opens is titled Certificate enrollment request and shows the request’s Protocol.
• An approved SCEP request is issued from the CA it was made against, under SCEP’s validity and networks.
• The same request sent over EST and over SCEP is two requests, each approved on its own. A device moved from EST to SCEP with the same key waits for a second approval.
• A renewal with an unchanged key is a new request each time, as for EST.

Only the device that made a request can poll it: a poll signed by any other key is answered as an unknown transaction.

Deciding takes PKI edit rights (nac_pki.edit), on the PKI page or by an email link. The details are on EST enrollment → Approvals.

The reply is encrypted with the cipher the device used. GetCACaps advertises AES, SHA-256, POSTPKIOperation, SCEPStandard and Renewal. Both GET and POST work for PKIOperation.

Single DES is refused and cannot be enabled. The challenge password, shared by every device, travels in the envelope: a 56-bit key can be broken offline from one captured request, and one old device would give away every device’s challenge. RFC 8894 forbids it. A device that offers only DES does not enroll over SCEP; give it a certificate by hand, or use EST if it speaks it.

The commands below are examples of each vendor’s SCEP client with the Taranac values filled in; check them against your platform’s documentation. Taranac’s SCEP was tested with Cisco IOS-XE 17.12 and MikroTik RouterOS 7.23. Replace nac.example.com with the host from the device URL and give each device its own name.

crypto pki trustpoint TARANAC
 enrollment url http://nac.example.com:8446/scep
 subject-name CN=r1.example.com
 subject-alt-name r1.example.com
 rsakeypair TARANAC 2048
 auto-enroll 80
!
crypto pki authenticate TARANAC
crypto pki enroll TARANAC

• crypto pki authenticate fetches the CA chain and asks you to accept its fingerprint. Compare it with the CA’s fingerprint on the PKI page.
• crypto pki enroll asks for a challenge password: enter the SCEP challenge.
• subject-alt-name gives the certificate the DNS name it needs. On IOS-XE every subject-alt-name entry is written as a DNS name, and the trustpoint’s ip-address goes into the subject, not the SAN, so the certificate carries no IP SAN.
• auto-enroll 80 renews at 80% of the lifetime, signed with the current certificate. IOS keeps its key unless told to regenerate it, so with approval on each renewal waits in the queue as a new request.
• IOS appends /pkiclient.exe to the URL itself; that path is served.

/certificate add name=r1-scep common-name=r1.example.com subject-alt-name=DNS:r1.example.com key-size=2048
/certificate add-scep template=r1-scep scep-url="http://nac.example.com:8446/scep" challenge-password="<challenge>"

RouterOS takes the CA from GetCACert and renews the certificate itself before it expires.

Every SCEP outcome is recorded as NAC_PKI_SCEP_ENROLLMENT: issued, queued for approval, approved, rejected and refused. A request refused after its message was read is answered with a signed SCEP failure whose text the device shows; refusals before that (source networks, a blocked address, a CA that cannot sign) are HTTP errors.

A refused request carries outcome: refused and a reason. Besides the reasons EST uses (see EST → Refused enrollments), SCEP has:

The CA reasons (ca_disabled, ca_expired, ca_revoked, ca_parent_unusable, ca_not_found) are the same as for EST, and the device sees the same text.

Port 8446 is published on every installation, whether SCEP is on or not. While SCEP is off it refuses every request, but the port is open. Published container ports are not filtered by the host’s ufw INPUT rules, for IPv4 or IPv6. If you do not use SCEP, or want to limit who reaches it, filter it in the DOCKER-USER chain, or set Networks devices may request certificates from. To move it, set SCEP_HTTP_PORT in .env and run ./taranac up -d; the URL on PKI Settings follows.

The SCEP endpoints answer on the gateway at /scep, /scep/pkiclient.exe and /cgi-bin/pkiclient.exe, with the operation in the operation query parameter.

For the console and automation:

The SCEP settings are scep_* fields of GET/PATCH /api/v1/nac/pki/settings. The challenge cannot be set through PATCH.

• EST enrollment: the same gateway for devices that speak EST, Device accounts and the approval queue in detail.
• PKI & trust: Internal CAs, revocation and the certificates SCEP issues.
• Taranac under your corporate root: a SCEP CA signed by your corporate PKI.
• Cisco IOS / IOS-XE and MikroTik RouterOS: device guides.
• Audit & syslog: the Activity Log and forwarding it to a SIEM.