Device > Certificate Management > SCEP
Table of Contents
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
End-of-Life (EoL)
Device > Certificate Management > SCEP
The simple certificate enrollment protocol (SCEP) provides
a mechanism for issuing a unique certificate to endpoints, gateways,
and satellite devices. Select DeviceCertificate ManagementSCEP to
create an SCEP configuration.
For more information on how to create a SCEP profile, refer
to Deploying Certificates Using SCEP
.To start a new SCEP configuration, click Add and
then complete the following fields.
SCEP Settings | Description |
---|---|
Name | Specify a descriptive Name to identify this
SCEP configuration, such as SCEP_Example. This name
distinguishes a SCEP profile from other instances that you might
have among the configuration profiles. |
Location | Select a Location for the profile if the
system has multiple virtual systems. The location identifies where
the SCEP configuration is available. |
One Time Password (Challenge) | |
SCEP Challenge | (Optional) To make SCEP-based certificate
generation more secure, you can configure a SCEP challenge-response
mechanism (a one-time password (OTP)) between the public key infrastructure
(PKI) and the portal for each certificate request. After
you configure this mechanism, its operation is invisible, and no
further input from you is necessary. The challenge
mechanism that you select determines the source of the OTP. If you
select Fixed, copy the enrollment challenge password
from the SCEP server for the PKI and enter the string in the portal’s Password dialog
that displays when configured as Fixed. Each
time the portal requests a certificate, it uses this password to
authenticate with the PKI. If you select Dynamic,
you enter the username and password of your choice (possibly the credentials
of the PKI administrator) and the SCEP Server URL where
the portal-client submits these credentials. This username and password
remains the same while the SCEP server transparently generates an
OTP password for the portal upon each certificate request. (You
can see this OTP change after a screen refresh in “The enrollment
challenge password is” field upon each certificate request.) The
PKI transparently passes each new password to the portal, which
then uses the password for its certificate request. To
comply with the U.S. Federal Information Processing Standard (FIPS),
select Dynamic, specify a Server
URL that uses HTTPS, and enable SCEP Server
SSL Authentication. (FIPS-CC operation is indicated
on the firewall login page and in the firewall status bar.) |
Configuration | |
Server URL | Enter the URL at which the portal requests
and receives client certificates from the SCEP server. Example:
|
CA-IDENT Name | Enter a string to identify the SCEP server.
Maximum length is 255 characters. |
Subject | Configure the Subject to include identifying
information about the device and optionally user and provide this
information in the certificate signing request (CSR) to the SCEP
server. When used to request client certificates for endpoints,
the endpoint sends identifying information about the device that includes
its host ID value. The host ID value varies by device type, either
GUID (Windows) MAC address of the interface (Mac), Android ID (Android
devices), UDID (iOS devices), or a unique name that GlobalProtect
assigns (Chrome). When used to request certificates for satellite
devices, the host ID value is the device serial number. To
specify additional information in the CSR, enter the Subject name.
The subject must be a distinguished name in the <attribute>=<value> format
and must include the common name (CN) key. For example: O=acme,CN=acmescep There are
two ways to specify the CN:
O=acme,CN=$HOSTID
O=acme,CN=acmescep |
Subject Alternative Name Type | After you select a type other than None,
a dialog displays for you to enter the appropriate value:
|
Cryptographic Settings |
|
Use as digital signature | Select this option to configure the endpoint
to use the private key in the certificate to validate a digital
signature. |
Use for key encipherment | Select this option to configure the client
endpoint to use the private key in the certificate to encrypt data
exchanged over the HTTPS connection established with the certificates
issued by the SCEP server. |
CA Certificate Fingerprint | (Optional) To ensure that the portal
connects to the correct SCEP server, enter the CA Certificate
Fingerprint. Obtain this fingerprint from the SCEP server
interface in the Thumbprint field. Log
in to the SCEP server’s administrative user interface (for example,
at http://<hostname or IP>/CertSrv/mscep_admin/). Copy the thumbprint
and enter it in CA Certificate Fingerprint. |
SCEP Server SSL Authentication | To enable SSL, select the root CA
Certificate for the SCEP server. Optionally, you can
enable mutual SSL authentication between the SCEP server and the
GlobalProtect portal by selecting a Client Certificate. |