Sample SCEP implementation

This sample shows a SCEP implementation using SSCEP on macOS.

Prerequisites:

A SCEP profile in your DigiCert® Private CA
SSCEP (Simple SCEP) client on macOS
OpenSSL

Initial setup:

Unzip sscep-mac.zip.
Run chmod +x sscep.
Move the binary to /usr/local/bin/.
Install OpenSSL 3 using Homebrew.

Enroll a client certificate

Enroll a new client certificate using the SCEP protocol and the created profile.

STEP 1: Prepare a certificate signing request (CSR)

Create an OpenSSL configuration file, for example csr.conf:

[req]
prompt = no
distinguished_name = dn
attributes = attr

[dn]
CN = device.example.com

[attr]
challengePassword = <enrollment-credential>

Where, <enrollment-credential> is the credential configured for initial enrollment:

For Global Authentication Code, enter the authentication code configured in the profile.
For One Time Passcode (OTP), enter the OTP generated for this enrollment. See Use a one-time passcode for enrollment.

Next, generate a private key and CSR using OpenSSL:

openssl req -new -newkey rsa:2048 -nodes \
 -keyout client.key \
 -out client.csr \
 -config csr.conf

STEP 2: Run the enrollment command

Replace the placeholders with your actual values:

sscep enroll \
  -u https://<ca-server>/certificate-authority/api/v1/scep/<ProfileID>/cgi-bin/pkiclient.exe \
  -k client.key \
  -r client.csr \
  -l device.crt \
  -c issuer.pem \
  -S sha1

Where:

-u is the SCEP URL generated from the SCEP profile in your private CA.
-k is the private key file required for your CSR.
-r is the CSR file which contains your certificate signing request.
-l is the placeholder for the output file. This is where you'll find the issued client certificate when the request is completed.
-c is the issuer certificate file (your private root CA or an intermediate CA). This certificate is necessary for the SCEP client to trust and securely communicate with the SCEP server (the server where your private CA is installed) during the enrollment process.
-S is the algorithm type.

Re-enroll a client certificate

Renew an existing client certificate using the SCEP protocol.

STEP 1: Prepare for re-enrollment

Make sure you have:

The existing client certificate.
The private key corresponding to the existing certificate.
The issuing CA certificate.

For re-enrollment, the existing certificate and private key authenticate the request. Do not reuse the Global Authentication Code or OTP from the initial enrollment.

Generate a new private key and CSR:

openssl genrsa -out renewal.key 2048

openssl req -new \
 -key renewal.key \
 -out renewal.csr \
 -subj "/CN=device.example.com"

STEP 2: Run the re-enrollment command

sscep enroll -d \
  -u https://<ca-server>/certificate-authority/api/v1/scep/<ProfileID>/cgi-bin/pkiclient.exe \
  -k renewal.key \
  -K client.key \
  -O device.crt \
  -r renewal.csr \
  -l renewed.crt \
  -c issuer.pem \
  -S sha1

Where:

-u is the SCEP URL generated from the SCEP profile in your private CA.
-k is the private key for the new certificate request..
-K is the private key associated with the existing certificate, used to authenticate the re-enrollment request.
-O is the existing certificate being renewed. It is also used along with -K to authenticate the re-enrollment request.
-r is the CSR file which contains your certificate signing request.
-l is the placeholder for the output file. This is where you'll find the renewed or re-enrolled client certificate when the request is completed.
-c is the issuer certificate file (your private root CA or an intermediate CA). This certificate is necessary for the SCEP client to trust and securely communicate with the SCEP server (the server where your private CA is installed) during the enrollment process.

In diesem Abschnitt: