Create the CSR for SCEP enrollment
Before enrolling a certificate via SCEP, you need to create a certificate signing request (CSR). You will send the CSR in your SCEP enrollment request.
The CSR supplies the values for the various certificate fields configured in the SCEP-enabled profile in DigiCert® Trust Lifecycle Manager.
The examples here show how to complete this process using the open source OpenSSL cryptographic tools, available for all major computer operating systems.
OpenSSL configuration file
To facilitate CSR generation, create an OpenSSL configuration file that contains:
Values for the certificate fields from your certificate profile in Trust Lifecycle Manager.
The enrollment code for the seat ID you are enrolling for a cert via SCEP, defined as
challengePassword.
The following example shows all supported SCEP fields in Subject DN and SAN extension, and a test enrollment code (challengePassword):
SAN_FIELDS = IP:10.0.0.10, URI:http://www.digicert.com/, RID:1.2.3.4, DNS:first.digicert.com, DNS:second.digicert.com, email:noreply@digicert.com, email:noreply@mailinator.com
[ req ]
prompt = no
distinguished_name = req_distinguished_name
req_extensions = req_ext
attributes = req_attributes
[ req_distinguished_name ]
CN = device-seat-01
1.OU = Test OU 1
2.OU = Test OU 2
O = Test Org
L = Test Locality
ST = Test State
C = US
postalCode = 02860
serialNumber = sn0001
unstructuredName = Test Unstructured Name
unstructuredAddress = Test Unstructured Address
description = Test Description
[ req_ext ]
subjectAltName = $SAN_FIELDS
[ req_attributes ]
challengePassword = RLW60QNN7WJ7Generate private key
You need to generate the private key for your certificate before creating the CSR.
RSA
For example, make the following command to use RSA with a 2048-bit private key, saving it to a file called device.pem.key:
openssl genrsa -out device.pem.key 2048
Create the CSR
Create the CSR based on your OpenSSL configuration file and private key.
For example, to create and save a CSR in a file called device.pem.csr, make the following command:
openssl req -new -sha256 -key device.pem.key -out device.pem.csr -config openssl.cfg
In this example:
The CSR is signed with the SHA-256 hashing algorithm (
sha256).The private key is stored in the
device.pem.keyfile.The CSR is created with the values from the OpenSSL configuration file called
openssl.cfg.
Convert CSR from PEM to DER
The SCEP server for Trust Lifecycle Manager expects CSRs to be in DER format.
To convert a PEM-encoded CSR file called device.pem.csr to DER format, outputting it to file device.der.csr, make the following command:
openssl req -in device.pem.csr -out device.der.csr -outform DER
What's next
Now that you have a CSR in DER format, you can use it to request a certificate via SCEP. For example, see Test using the DigiCert SCEP client.