Skip to content

Windows SCEP profile validation accepts CERTIFICATE_RENEWAL_ID (PR 7/9) #45237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mostlikelee merged 21 commits into from
May 14, 2026
Merged

Windows SCEP profile validation accepts CERTIFICATE_RENEWAL_ID (PR 7/9) #45237

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
2aef3c5
Apple ACME profile validation + accept CERTIFICATE_RENEWAL_ID variable
mostlikelee May 8, 2026
905ccc1
Backmerge 40639-cert-renew into pr-2.3-apple-validation-rename
mostlikelee May 11, 2026
c227e4f
Update tests to expect CERTIFICATE_RENEWAL_ID in error messages
mostlikelee May 11, 2026
f512a2b
Add back-compat test for legacy $FLEET_VAR_SCEP_RENEWAL_ID
mostlikelee May 12, 2026
cc011da
remove changes file
mostlikelee May 12, 2026
b397e9e
simplify comment
mostlikelee May 12, 2026
236eb10
Merge branch 'pr-2.3-apple-validation-rename' of https://github.com/f…
mostlikelee May 12, 2026
2417cd8
Backmerge 40639-cert-renew into pr-2.3-apple-validation-rename
mostlikelee May 12, 2026
e62a4b6
remove legacy name support in acme
mostlikelee May 12, 2026
f49c8ca
use acme const
mostlikelee May 12, 2026
b67f0e2
Backmerge 40639-cert-renew into pr-2.3-apple-validation-rename
mostlikelee May 12, 2026
6eaf97e
concise comments
mostlikelee May 12, 2026
f7e9849
Use Mobileconfig.HasPayloadType for ACME bypass detection
mostlikelee May 12, 2026
31401cf
Windows SCEP profile validation accepts CERTIFICATE_RENEWAL_ID
mostlikelee May 12, 2026
8450ba0
Merge remote-tracking branch 'origin/40639-cert-renew' into pr-2.3b-r…
mostlikelee May 12, 2026
ac19cc0
Merge remote-tracking branch 'origin/40639-cert-renew' into pr-2.3b-r…
mostlikelee May 12, 2026
7d6da1d
Merge remote-tracking branch 'origin/40639-cert-renew' into pr-2.3b-r…
mostlikelee May 12, 2026
c354fba
Apple non-proxied SCEP profile validation
mostlikelee May 13, 2026
105fe77
Merge remote-tracking branch 'origin/40639-cert-renew' into pr-2.3b-r…
mostlikelee May 13, 2026
2fb477c
Merge remote-tracking branch 'origin/pr-2.3b-raw-scep-validation' int…
mostlikelee May 13, 2026
ad03d2d
Merge remote-tracking branch 'origin/40639-cert-renew' into pr-2.4-wi…
mostlikelee May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions server/service/windows_mdm_profiles.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,7 @@ var fleetVarsSupportedInWindowsProfiles = []fleet.FleetVarName{
fleet.FleetVarHostHardwareSerial,
fleet.FleetVarSCEPWindowsCertificateID,
fleet.FleetVarSCEPRenewalID,
fleet.FleetVarCertificateRenewalID,
fleet.FleetVarHostEndUserIDPUsername,
fleet.FleetVarHostEndUserIDPUsernameLocalPart,
fleet.FleetVarHostEndUserIDPFullname,
Expand All @@ -158,6 +159,18 @@ var fleetVarsSupportedInWindowsProfiles = []fleet.FleetVarName{
fleet.FleetVarNDESSCEPProxyURL,
}

// subjectNameHasRenewalIDMarker reports whether a SubjectName data string
// contains the renewal-ID variable in OU=. The legacy SCEP_RENEWAL_ID name
// is accepted alongside CERTIFICATE_RENEWAL_ID for back-compat.
func subjectNameHasRenewalIDMarker(data string) bool {
for _, v := range []fleet.FleetVarName{fleet.FleetVarCertificateRenewalID, fleet.FleetVarSCEPRenewalID} {
if strings.Contains(data, "OU="+v.WithPrefix()) || strings.Contains(data, "OU="+v.WithBraces()) {
return true
}
}
return false
}

func validateWindowsProfileFleetVariables(contents string, lic *fleet.LicenseInfo, groupedCAs *fleet.GroupedCertificateAuthorities) ([]string, error) {
foundVars := variables.Find(contents)
if len(foundVars) == 0 {
Expand Down Expand Up @@ -283,11 +296,9 @@ func additionalNDESValidationForWindowsProfiles(contents string, ndesVars *NDESV
"Variable %q must be in the SCEP certificate's \"ServerURL\" field.", fleet.FleetVarNDESSCEPProxyURL.WithPrefix()),
}
}
if isSubjectName &&
!strings.Contains(dataContent, "OU="+fleet.FleetVarSCEPRenewalID.WithPrefix()) &&
!strings.Contains(dataContent, "OU="+fleet.FleetVarSCEPRenewalID.WithBraces()) {
if isSubjectName && !subjectNameHasRenewalIDMarker(dataContent) {
return &fleet.BadRequestError{
Message: fmt.Sprintf("SubjectName item must contain the %s variable in the OU field", fleet.FleetVarSCEPRenewalID.WithPrefix()),
Message: fmt.Sprintf("SubjectName item must contain the %s variable in the OU field", fleet.FleetVarCertificateRenewalID.WithPrefix()),
}
}
}
Expand Down Expand Up @@ -325,9 +336,8 @@ func additionalCustomSCEPValidationForWindowsProfiles(contents string, customSCE
return errors.New("SubjectName item is missing data")
}

if !strings.Contains(cmd.Data.Content, "OU="+fleet.FleetVarSCEPRenewalID.WithPrefix()) && !strings.Contains(cmd.Data.Content, "OU="+fleet.FleetVarSCEPRenewalID.WithBraces()) {
// Does not contain the renewal ID in any of it's two fleet var forms as the OU field
return fmt.Errorf("SubjectName item must contain the %s variable in the OU field", fleet.FleetVarSCEPRenewalID.WithPrefix())
if !subjectNameHasRenewalIDMarker(cmd.Data.Content) {
return fmt.Errorf("SubjectName item must contain the %s variable in the OU field", fleet.FleetVarCertificateRenewalID.WithPrefix())
}
}
}
Expand Down
14 changes: 13 additions & 1 deletion server/service/windows_mdm_profiles_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,7 +268,19 @@ func TestAdditionalNDESValidationForWindowsProfiles(t *testing.T) {
addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/ServerURL", "$FLEET_VAR_NDES_SCEP_PROXY_URL") +
addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/SubjectName", "CN=test"),
wantErr: true,
errContains: "SubjectName item must contain the $FLEET_VAR_SCEP_RENEWAL_ID variable in the OU field",
errContains: "SubjectName item must contain the $FLEET_VAR_CERTIFICATE_RENEWAL_ID variable in the OU field",
},
{
name: "valid NDES profile with preferred CERTIFICATE_RENEWAL_ID",
contents: addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/Challenge", "$FLEET_VAR_NDES_SCEP_CHALLENGE") +
addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/ServerURL", "$FLEET_VAR_NDES_SCEP_PROXY_URL") +
addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/SubjectName", "CN=test,OU=$FLEET_VAR_CERTIFICATE_RENEWAL_ID"),
},
{
name: "valid NDES profile with preferred CERTIFICATE_RENEWAL_ID (braces syntax)",
contents: addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/Challenge", "${FLEET_VAR_NDES_SCEP_CHALLENGE}") +
addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/ServerURL", "${FLEET_VAR_NDES_SCEP_PROXY_URL}") +
addItem("./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/cert1/Install/SubjectName", "CN=test,OU=${FLEET_VAR_CERTIFICATE_RENEWAL_ID}"),
},
{
name: "nil ndes vars returns nil",
Expand Down
Loading