Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Does step-ca support SCEP manual mode? #1170

Open
abotelho-cbn opened this issue Nov 9, 2022 · 4 comments · May be fixed by #1502
Open

Does step-ca support SCEP manual mode? #1170

abotelho-cbn opened this issue Nov 9, 2022 · 4 comments · May be fixed by #1502
Assignees
@hslatman
Labels
enhancement

Comments

@abotelho-cbn
Copy link

abotelho-cbn commented Nov 9, 2022 •
edited
Loading

Hello!

  • Vote on this issue by adding a 👍 reaction
  • If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Does step-ca support SCEP manual mode?

According to the SCEP RFC (https://www.rfc-editor.org/rfc/rfc8894), section 2.4 (https://www.rfc-editor.org/rfc/rfc8894#name-enrolment-authorisation) SCEP servers can optionally put SCEP clients in a pending mode:

To perform the authorisation in manual mode, the client's request is placed in the PENDING state until the CA operator authorises or rejects it. Manual authorisation is used when the client has only a self-signed certificate that hasn't been previously authenticated by the CA and/or a challengePassword is not available. The SCEP CA MAY either reject unauthorised requests or mark them for manual authorisation according to CA policy.

Why is this needed?

We're looking at a few options for CA servers, and some of them have implemented this functionality. Notable CA servers that support this are Dogtag PKI and EJBCA Enterprise. It helps in situations where you have some trust, but not perfect trust in the end device's environment, and validation of the requests by a human is required. For example, a remote SysAdmin approving requests from a remote location. As per RFC 8894, a challenge password (as step-ca seems to use at the moment) can be paired with pending/manual mode.

Edit 1

I'm not super familiar with Golang generally, but after doing some digging I can see that SCEP in step-ca uses the scep Go package, which appears to support the PENDING status message. I hope this means it should be possible to add manual mode to step-ca.
@abotelho-cbn abotelho-cbn added enhancement needs triage Waiting for discussion / prioritization by team labels Nov 9, 2022
@hslatman
Copy link
Member

hslatman commented Nov 9, 2022 •
edited
Loading

Hi @abotelho-cbn: at the moment our SCEP implementation doesn't support manual approval. We offer a fairly basic SCEP integration at this time, primarily geared towards automated enrollment, as step-ca has targeted the automated use cases more so than manual certificate issuance. We do offer a form of manual approval in our hosted offering, but that's not (yet) fully integrated with our SCEP integration; it can be used with other provisioners, though.

You're right about the library we use; it has support for the PENDING state, so technically it is possible to implement. There's more to it, though, as it would require the certificate requests to be stored intermittently. A mechanism to make an administrator act on the request also needs to be added.

Your explanation on why manual approval with SCEP makes it a more trustworthy enrollment absolutely makes sense to me. Lately we have had some more discussions with people that need SCEP. Most of these discussions are concluded with the fact that we need some extensions/improvements to our current integration. Your feature request seems to fit well with the other things already discussed. Would you be open to talk about what you need and why you need it with one of my colleagues?

One final question: does your use case and/or environment require certificate issuance via SCEP, or would a different method/protocol also be an option to you?

@abotelho-cbn
Copy link
Author

SCEP is a hard requirement in fact. We have equipment that uses the G2S standard (https://www.gamingstandards.com/en/standards/g2s-game-system) which requires SCEP for interoperability reasons.

I'd be open to further discussion!

@hslatman
Copy link
Member

hslatman commented Nov 15, 2022 •
edited
Loading

@abotelho-cbn are you on our Discord by any chance? I would like to send you an invite to set up a meet.

@abotelho-cbn
Copy link
Author

Just joined! abotelhocbn#6332

@dopey dopey removed the needs triage Waiting for discussion / prioritization by team label Jan 6, 2023
@adrian-alexander adrian-alexander linked a pull request Aug 4, 2023 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@hslatman hslatman

Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Support for SCEP Polling adrian-alexander/certificates
3 participants
@hslatman @dopey @abotelho-cbn