STRONGSWAN_PKI---SCEP(1)

📦
version 6.0.7 · 4 versions
, in fedora 43, fedora 44

💖 PKI --SCEP(1) 💖

okay bestie, grab a lil snack 🍓 because we're about to enroll certificates like it's nothing. This is the manual page for pki --scep, the strongSwan sub-command that goes and gets you an X.509 cert from a SCEP server. it's giving ✨secure✨ and honestly? obsessed.

🌸 NAME 🌸

pki --scep — enroll an X.509 certificate with a SCEP server 💅

🎀 SYNOPSIS 🎀

Like, here's how you actually call it:

pki --scep --url url [--in file] [--dn  distinguished-name]
           [--san subjectAltName] [--profile profile]
           [--password password] --ca-cert-enc file --ca-cert-sig file
           [--cacert file] [--cert file --key file] [--cipher cipher]
           [--digest digest] [--rsa-padding padding] [--interval time]
           [--maxpolltime time] [--outform encoding] [--debug level]

Or, if you want to be lazy in the best way and read your options from a file:

pki --scep --options file

Or, if you just need help:

pki --scep -h | --help

🦋 DESCRIPTION 🦋

So this sub-command of pki(1) sends a PKCS#10 certificate request inside an encrypted and signed PKCS#7 container over HTTP to a SCEP server, using the Simple Certificate Enrollment Protocol (RFC 8894). periodt. Once authorization goes through — and heads up, with manual authentication that means your enrollment client has to keep periodically polling 👀 — the SCEP server hands back an X.509 certificate signed by the CA.

And here's the glow-up moment: before your current certificate expires, you can request a brand new client certificate based on a fresh RSA private key, and it'll use the old certificate and the old key to automatically authenticate with the SCEP server. no manual labor, we love to see it. 💖

✨ OPTIONS ✨

  • -h, --help — prints the usage info plus a summary of all the available options. your lil cheat sheet.
  • -v, --debug level — sets the debug level, default: 1.
  • -+, --options file — reads the command line options from file. (yes the flag is literally -+, iconic behavior, we don't question it)
  • -u, --url url — the URL of the SCEP server.
  • -i, --in file — the RSA private key. If you don't give it, the key gets read from STDIN. 🙈
  • -d, --dn distinguished-name — the subject distinguished name (DN). It's required unless you passed --cert.
  • -a, --san subjectAltName — the subjectAltName extension to include in the request. You can use this one multiple times. 🌈
  • -P, --profile profile — the certificate profile name to include in the certificate request. Can be any UTF8 string. Supported e.g. by the openxpki SCEP server, with profiles (pc-client, tls-server, etc.) that get translated into the corresponding Extended Key Usage (EKU) flags in the generated X.509 certificate.
  • -p, --password password — the challengePassword to include in the certificate request.
  • -e, --cacert-enc file — the CA or RA certificate used for encryption.
  • -s, --cacert-sig file — the CA certificate used for signature verification.
  • -C, --cacert file — an additional CA certificate in the trust chain, used for signature verification. Can be used multiple times.
  • -c, --cert file — the client certificate that's getting renewed.
  • -k, --key file — the client RSA private key that's being replaced.
  • -E, --cipher cipher — the cipher used for symmetric encryption. Either aes (the default) or des3.
  • -g, --digest digest — the digest to use for signature creation. One of sha256 (the default), sha384, sha512, or sha1.
  • -R, --rsa-padding padding — the padding to use for RSA signatures. Either pkcs1 (the default) or pss.
  • -t, --interval time — the poll interval in seconds, defaults to 60s. ⏰
  • -m, --maxpolltime time — the maximum poll time in seconds, defaults to 0, which means unlimited polling. it will simply never stop waiting for you. devotion.
  • -f, --outform encoding — the encoding of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to der.

💫 EXAMPLES 💫

To save some typing work 😮‍💨 the following command line options are stored in a scep.opt file:

--url http://pki.strongswan.org:8080/scep
--cacert-enc myra.crt
--cacert-sig myca-1.crt
--cacert myca.crt

With the following command, an X.509 certificate signed by the intermediate CA is requested from a SCEP server:

pki --options scep.opt --in moonKey.der --san "moon.strongswan.org" \
    --dn "C=CH, O=strongSec GmbH, CN=moon.strongswan.org" > moonCert.der

and it looks a lil something like this 👇

transaction ID: 4DFCF31CB18A9B5333CCEC6F99CF230E4524E334
  using certificate "C=CH, O=strongSwan Project, CN=SCEP RA"
  using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 1
  SCEP request pending, polling indefinitely every 60 seconds
  going to sleep for 60 seconds
transaction ID: 4DFCF31CB18A9B5333CCEC6F99CF230E4524E334
  ...
  going to sleep for 60 seconds
Issued certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
  serial: 1e:ff:22:7b:6e:d7:4c:c1:8a:06
  using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
  using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 1
Issued certificate is trusted, valid from Aug 22 18:56:23 2022 until Aug 22 18:56:23 2023 (currently valid)

A certificate about to expire can be renewed with the command:

pki --options scep.opt --in moonNewKey.der --san "moon.strongswan.org" \
    --dn "C=CH, O=strongSec GmbH, CN=moon.strongswan.org" \
    --cert moonCert.der --key moonKey.der > moonNewCert.der

which goes a little like:

transaction ID: A9A63D028CC439F68452D125C4DBA025E67DBA95
  using certificate "C=CH, O=strongSwan Project, CN=SCEP RA"
  using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 1
Issued certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
  serial: 1f:ff:b2:78:43:a2:9d:85:00:38
  using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
  using trusted intermediate ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 1
Issued certificate is trusted, valid from Jul 20 15:05:33 2023 until Jul 20 15:05:33 2024 (currently valid)

renewed, trusted, and thriving. main character energy fr fr. 👑

🫶 SEE ALSO 🫶

and that's the whole vibe, bestie 💜 this page is from strongSwan 6.0.7, dated 2022-08-22. go forth and enroll something iconic ✨🧚‍♀️🎀

📦 where this page comes from