This module implements a Simple Certificate Enrollment Protocol endpoint that is capable of signing and issuing certificates on behalf of a suitable client.

Based on configuration, parameters can be passed from the incoming certificate sign request embedded within the SCEP request, or explicit expressions, and a new certificate sign request with acceptable parameters is passed to suitably configured backend modules for request authorisation, certificate signing and issuing, and certificate storage.

The following SCEP operations are supported:

This module can be configured to respond to SCEP client requests as implemented by iOS and MacOS.

This optional hook allows you to verify the parameters included with the certificate sign request, such as the challenge password. If left unconfigured, all certificate requests will be accepted.

This hooks signs the certificate sign request and returns the issued certificate. The hook is mandatory, and the request will be rejected if left unconfigured.

This optional hook allows the newly generated certificate to be stored locally or in a database or directory. If left unconfigured, no local copy of the certificate will be stored.

This hook returns certificates that were requested previously and generated at a possibly later date or time.

This hook returns CA certificates for the given CA.

This hook returns certificates that were requested previously and generated at a possibly later date or time.

The simplest case: issue a certificate to anybody who wants one.

                  
  # sign with this certificate...
  CASimpleCertificate /etc/pki/tls/ca-cert.pem
  # ...and private key
  CASimpleKey /etc/pki/tls/ca-key.pem
  # use system clock as the time source
  CASimpleTime on
  # assign a random serial number
  CASimpleSerialRandom on


# frontend configuration:

  
    SetHandler scep
    # use subject from the certificate sign request unmodified
    ScepSubjectRequest *
  

]]>
                

A more typical scenario: issue a certificate to a logged in user.

In this example it is assumed that Apache configuration exists that authenticates a user against a database, directory, a token, or a previous certificate.

                  
  # sign with this certificate...
  CASimpleCertificate /etc/pki/tls/ca-cert.pem
  # ...and private key
  CASimpleKey /etc/pki/tls/ca-key.pem
  # use system clock as the time source
  CASimpleTime on
  # assign a random serial number
  CASimpleSerialRandom on


# frontend configuration:

  
    SetHandler scep
    # standard Apache authorisation
    Require valid-user
    # set the common name to the logged in username
    ScepSubjectSet CN %{REMOTE_USER}
    # set a fixed OU field in the subject
    ScepSubjectSet OU "Terms and Conditions Apply"
  

]]>
                

After calling the request authorization hook, the sign request hook, and the certificate storage hook, issue and return the certificate using the SCEP protocol.

If set, attempts at GetCRL will be redirected to this URL. GetCRL will be rejected with 400 Bad Request otherwise.

The age of the certificates will be divided by this factor when added as a max-age, set to zero to disable. Defaults to "2". An optional maximum value can be specified, defaults to one day.

Set the URL location of the WADL returned by the OPTIONS method.

Set to the name of the signing certificate.

Set to the name of the signing key.

Set to the name of the next RA signing certificate.

Set to the maximum size of the SCEP request from the client. This value cannot be smaller than 4096 bytes.

Specify fields in the certificate request subject alternative name that will be copied over to the certificate, with optional limit to the number of fields that may appear.

If a wildcard is used, all fields in the certificate request subject alternative name will be copied across unmodified.

Field names are limited to otherName, rfc822Name, dNSName, x400Address, directoryName, ediPartyName, uniformResourceIdentifier, iPAddress, or registeredID and are described in the Subjects and Subject Alternative Names section.

Specify an expression that will be included in the certificate subject alternative name.

Field names are limited to otherName, rfc822Name, dNSName, x400Address, directoryName, ediPartyName, uniformResourceIdentifier, iPAddress, or registeredID and are described in the Subjects and Subject Alternative Names section.

Specify fields in the certificate request subject that will be copied over to the certificate, with optional limit to the number of fields that may appear.

If a wildcard is used, all fields in the certificate request subject alternative name will be copied across unmodified.

Subject handling is covered in detail in the Subjects and Subject Alternative Names section.

Specify an expression that will be included in the certificate subject. Subject attribute name is configured first, then the expression.

Subject handling is covered in detail in the Subjects and Subject Alternative Names section.