SCEP

Overview

Simple Certificate Enrollment Protocol (SCEP) is defined in RFC 8894.

SCEP makes extensive use of CMS defined in RFC5652 and PKCS #10 defined in RFC2986.

PKI Message

pkiMessage {
  contentType = signedData { pkcs-7 2 },
  content {
    digestAlgorithms,
    encapsulatedContentInfo {
      eContentType = data { pkcs-7 1 },
      eContent {           -- pkcsPKIEnvelope, optional
        contentType = envelopedData { pkcs-7 3 },
        content {
          recipientInfo,
          encryptedContentInfo {
            contentType = data { pkcs-7 1 },
            contentEncrAlgorithm,
            encryptedContent {
              messageData  -- Typically PKCS #10 request
            }
          }
        }
      }
    },
    certificates,          -- Optional
    crls,                  -- Optional
    signerInfo {
      signedAttrs {
        transactionID,
        messageType,
        pkiStatus,
        failInfo,          -- Optional
        senderNonce / recipientNonce,
      },
      signature
    }
  }
}

See Section 3 SCEP Secure Message Objects.

Get CA Capabilities

Request:

GET /cgi-bin/pkiclient.exe?operation=GetCACaps HTTP/1.1

Response:

AES
GetNextCACert
POSTPKIOperation
SCEPStandard
SHA-256

See Section 3.5 CA Capabilities.

Get CA Certificate

Request:

GET /cgi-bin/pkiclient.exe?operation=GetCACert HTTP/1.1

CA certificate response:

Content-Type: application/x-x509-ca-cert

<binary X.509>

CA certificate chain response:

Content-Type: application/x-x509-ca-ra-cert

<binary CMS>

See Section 4.2 Get CA Certificate.

Certificate Enrollment/Renewal

POST request:

POST /cgi-bin/pkiclient.exe?operation=PKIOperation HTTP/1.1
Content-Length: <length of data>
Content-Type: application/x-pki-message

<binary CMS data>

GET request:

GET /cgi-bin/pkiclient.exe?operation=PKIOperation& \
message=MIAGCSqGSIb3DQEHA6CAMIACAQAxgDCBzAIBADB2MG \
IxETAPBgNVBAcTCE......AAAAAA== HTTP/1.1

Response:

Content-Type: application/x-pki-message

<binary CertRep message>

See Section 4.3 Certificate Enrolment/Renewal.

Certificate Access

IssuerAndSerialNumber ::= SEQUENCE {
  issuer Name,
  serialNumber CertificateSerialNumber }

CertificateSerialNumber ::= INTEGER

See Section 4.5 Certificate Access.

CRL Access

IssuerAndSerialNumber ::= SEQUENCE {
  issuer Name,
  serialNumber CertificateSerialNumber }

CertificateSerialNumber ::= INTEGER

See Section 4.6 CRL Access.