Tag: RFC 8894

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

Understanding the roles involved is essential for designing a public key infrastructure.

The term "public key infrastructure" encompasses much more than the technical components and is often used in a misleading way.

In summary, a public key infrastructure is both an authentication technology and the totality of all the components involved.

Continue reading "Roles in a public key infrastructure"

As computing power becomes increasingly available, the need to use stronger cryptographic keys also increases. In this course, there is often a need (for example, because the keys have to be protected by a Trusted Platform Module) to use keys based on elliptic curves (ECC) . For their use, it is essential that compatibility with the intended use cases is ensured.

Below is a list of use cases for which I know the compatibility.

Continue reading "List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known"

If you want to equip a large number of systems with certificates, a manual request and renewal of the certificates is not an option. The only viable path is automation.

For systems that are not members of the Active Directory forest, an automatic certificate request via RPC/DCOM is not an option.

For certain use cases, the Simple Certificate Enrollment Protocol (SCEP) is an interesting alternative. For this protocol, there are clients not only for Windows but, with SSCEP, also for Linux. SSCEP is used, among others, by thin clients with the eLux operating system .

The following describes how to set up the SSCEP client on a Debian Buster Linux system - either to use it to manage servers or to be able to test the client-side behavior.

Continue reading "Install SSCEP for Linux (Debian Buster) and request certificates via the Network Device Enrollment Service (NDES)"

The Simple Certificate Enrollment Protocol (SCEP) was developed by Verisign for Cisco in the early 2000s to provide a simplified method for requesting certificates. Previously, network devices required manually generating a certificate request on each device, submitting it to a certification authority, and then manually installing the issued certificate on the corresponding device again.

Continue reading "Basics: Network Device Enrollment Service (NDES)"

The Network Device Enrollment Service (NDES) has the ability to authenticate with a previously issued certificate in order to request a certificate with the same content again. This is very convenient for renewal operations, as it eliminates the need to request a one-time password beforehand.

Continue reading "Authentication at the Network Device Enrollment Service (NDES) with an existing certificate (renewal mode)"