Certificate handling with SCEP

Certificate handling with SCEP

SCEP is a protocol designed to simplify secure and scalable issuing of certificates to network devices in large-scale environments.

With SCEP, the devices take care of their certificates themselves. To do so, they require a one-time password created by an authorized person. With such a time-limited password (Windows: 60 minutes), a device can request a certificate from the SCEP service.

To prevent the certification authority (CA) from issuing arbitrary certificates with the one-time password, create a template in which you restrict the certificate classes.

By using SCEP you can simplify certificate issuing and management for uses such as

  • 802.1X authentication for LAN and WLAN
  • VPN connection via Cisco AnyConnect
  • Connection via Citrix NetScaler Gateway

The eLux implementation is based on the OpenSCEP project. The following description requires the use of Windows NDES.

Certificate handling with SCEP