How to configure Simple Certificate Enrollment Protocol (SCEP) in the SonicWall

03/26/2020 13 People found this article helpful 477,859 Views

Description

The Simple Certificate Enrollment Protocol (SCEP) is designed to support the secure issuance of certificates to network devices in a scalable manner. There are two enrollment scenarios for SCEP:

SCEP server CA automatically issues certificates
SCEP request is set to PENDING and the CA administrator manually issues the certificate

In this configuration the SonicWall will act as a client and will require a SCEP server to request a certificate from. In this article we use a MS Windows Server 2008 as the SCEP server running Network Device Enrollment Service, Internet Information Services (IIS), Domain Controller and Certificate Services.

Resolution

Before beginning the SonicWall configuration, make sure the MS Windows Server 2008 has been installed with the following services:

Certificate Authority
Certification Authority Web Enrollment
Network Device Enrollment Service
Internet Information Services

For information, refer the Microsoft SCEP Implementation Whitepaper

To configure SCEP to issue certificates, follow these steps:

Generate a signing request

Obtain a Challenge Password from http://<server IP or server name>/certsrv/mscep_admin

Scroll to the bottom of the System > Certificates page and click on the SCEP button. The SCEP Configuration window displays.
In the CSR List pulldown menu, the UI will automatically select a default CSR list. If you have multiple CSR lists configured, you can modify this.
In the CA URL field, enter the URL for the Certificate Authority.
If the Challenge Password field, enter the password for the CA if one is required.
In the Polling Interval(S) field, you can modify the default value for duration of time in seconds in between when polling messages are sent.
In the Max Polling Time(S) field, you can modify the default value for the duration of time the firewall will wait for a response to a polling message before timing out.
Click the Scep button to submit the SCEP enrollment.

The firewall will then contact the CA to request the certificate. The duration of time this will take depends on whether the CA issues certificates automatically or manually. The Log > View page will display messages on the status of the SCEP enrollment and issuance of the certificate. After the certificate is issued, it will be displayed in the list of available certificates on the System > Certificates page, under the Imported certificates and requests category.

Troubleshooting

Make sure Network Device Enrollment Service is installed and started.
Make sure the Challenge Password is the latest. Passwords are by default valid for 60 minutes.
Make sure the IP address or domain name of the server is correct.
Make sure the CA URL is correct.

Not Finding Your Answers?

ASK THE COMMUNITY

Was This Article Helpful?

YES NO

How to configure Simple Certificate Enrollment Protocol (SCEP) in the SonicWall

Description

Resolution

Related Articles

Categories

Not Finding Your Answers?

Was This Article Helpful?

Article Helpful Form

Article Not Helpful Form

Follow Us

Subscribe to newsletter

Stay In Touch