How to configure Simple Certificate Enrollment Protocol (SCEP) in the SonicWall

The Simple Certificate Enrollment Protocol (SCEP) is designed to support the secure issuance of certificates to network devices in a scalable manner. There are two enrollment scenarios for SCEP:

• SCEP server CA automatically issues certificates
• SCEP request is set to PENDING and the CA administrator manually issues the certificate

In this configuration the SonicWall will act as a client and will require a SCEP server to request a certificate from. In this article we use a MS Windows Server 2008 as the SCEP server running Network Device Enrollment Service, Internet Information Services (IIS), Domain Controller and Certificate Services.

Before beginning the SonicWall configuration, make sure the MS Windows Server 2008 has been installed with the following services:

• Certificate Authority
• Certification Authority Web Enrollment
• Network Device Enrollment Service
• Internet Information Services

For information, refer the Microsoft SCEP Implementation Whitepaper

To configure SCEP to issue certificates, follow these steps:

Generate a signing request

Obtain a Challenge Password from http://<server IP or server name>/certsrv/mscep_admin

• Scroll to the bottom of the System > Certificates page and click on the SCEP button. The SCEP Configuration window displays.
• In the CSR List pulldown menu, the UI will automatically select a default CSR list. If you have multiple CSR lists configured, you can modify this.
• In the CA URL field, enter the URL for the Certificate Authority.
• If the Challenge Password field, enter the password for the CA if one is required.
• In the Polling Interval(S) field, you can modify the default value for duration of time in seconds in between when polling messages are sent.
• In the Max Polling Time(S) field, you can modify the default value for the duration of time the firewall will wait for a response to a polling message before timing out.
• Click the Scep button to submit the SCEP enrollment.

The firewall will then contact the CA to request the certificate. The duration of time this will take depends on whether the CA issues certificates automatically or manually. The Log > View page will display messages on the status of the SCEP enrollment and issuance of the certificate. After the certificate is issued, it will be displayed in the list of available certificates on the System > Certificates page, under the Imported certificates and requests category.

Troubleshooting

• Make sure Network Device Enrollment Service is installed and started. 
• Make sure the Challenge Password is the latest. Passwords are by default valid for 60 minutes.
• Make sure the IP address or domain name of the server is correct.
• Make sure the CA URL is correct.