STRONGSWAN_PKI---SCEPCA(1)

💖 NAME 💖

Okay so welcome to the manual page for PKI --SCEPCA(1), bestie. This is the glow-up guide to pki --scepca — and what it does is Get CA [and RA] certificate[s] from a SCEP server. That's the whole vibe. 🎀

---

🌸 SYNOPSIS 🌸

Like, here's how you actually call her:

pki --scepca --url url [--caout file] [--raout file]
             [--outform encoding] [--force] [--debug level]

pki --scepca --options file

pki --scepca -h | --help

---

🦋 DESCRIPTION 🦋

So this sub-command of pki(1) is literally out here pulling CA and RA certificates via http from a SCEP server, using the GetCACert command of the Simple Certificate Enrollment Protocol — which is RFC 8894, iykyk. 📜✨

---

💅 OPTIONS 💅

• -h, --help — prints usage info plus a lil summary of all the options available. Your safety net, fr. 🫶
• -v, --debug level — sets the debug level. Default is 1. Turn it up if you wanna see everything. 👀
• -+, --options file — reads command line options straight from file. Yes the flag is literally -+, she's quirky like that. 💅
• -u, --url url — the URL of the SCEP server. The main character of this whole operation. 👑
• -c, --caout file — if present, this is the path where the fetched root CA certificate file gets stored. Now listen: if several CA certificates get downloaded, then the value of --caout is used as a template to derive unique filenames (*-1, *-2, etc.) for the intermediate or sub CA certificates. If a file suffix is missing, then depending on the value of --outform either .der (the default) or .pem is automatically appended. And if the --caout option is missing <em>and</em> --outform is set to pem, then a PEM-encoded CA certificate bundle is written to stdout. No cap. 📤
• -r, --raout file — if present, path where the fetched RA certificate file gets stored. If multiple RA certificates are available, then the value of --raout is used as a template to derive unique filenames (*-2, etc.). If the --raout option is missing, then the value of --caout is used as a template to derive unique filenames (*-ra, *-ra-2, etc.) for the RA certificates. And if a file suffix is missing, then depending on the value of --outform either .der (the default) or .pem is automatically appended. Slay. 🧚
• -f, --outform encoding — the encoding of the created certificate file. Either der (ASN.1 DER) or pem (Base64 PEM). Defaults to der. Pick your fighter. ⚔️
• -F, --force — forces overwrite of existing files. She will not hesitate. 💀

---

✨ EXAMPLES ✨

Okay here's where it gets iconic. Say a SCEP server sends a root CA and an intermediate CA certificate as well as an RA certificate:

pki --scepca --url http://pki.strongswan.org:8080/scep --caout myca.crt --raout myra.crt

And then the output is like:

Root CA cert "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  serial: 65:31:00:ca:79:da:16:6b:aa:ac:89:e2:a8:f9:49:c3:10:ab:64:54
  SHA256: 96:70:50:51:cd:b9:e7:94:6b:04:f6:15:45:80:fc:90:85:01:71:2a:f6:4f:d1:1b:2d:a1:7e:eb:bf:dd:be:86
  SHA1  : 8e:f3:78:b0:34:a6:c1:6a:7b:c6:f5:91:eb:e5:46:9b:0d:0a:a7:ba (jvN4sDSmwWp7xvWR6+VGmw0Kp7o)
Root CA cert is untrusted, valid until Aug 12 15:51:34 2032, 'myca.crt'
Sub CA cert "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  serial: 74:f9:7e:72:7d:b8:fd:f2:c6:e5:1b:fa:37:f9:cb:87:bf:9c:ea:e2
  SHA256: a3:5b:4b:12:d5:8f:68:7b:05:11:08:27:f5:42:62:b8:b5:01:1b:19:37:9c:28:78:5d:37:08:69:6a:8c:07:bf
  SHA1  : 8c:e6:67:67:c2:23:89:7b:d0:bc:b1:50:d2:1c:bc:8d:8d:69:15:11 (jOZnZ8IjiXvQvLFQ0hy8jY1pFRE)
  using certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 0
Sub CA cert is trusted, valid until Aug 12 15:51:34 2027, 'myca-1.crt'
RA cert "C=CH, O=strongSwan Project, CN=SCEP RA"
  serial: 74:f9:7e:72:7d:b8:fd:f2:c6:e5:1b:fa:37:f9:cb:87:bf:9c:ea:e3
  SHA256: 57:22:f3:13:69:2f:24:82:12:59:8e:05:63:0b:f5:a8:fb:4e:78:87:8d:68:d1:4c:c1:c4:b5:85:db:bb:64:df
  SHA1  : bc:d1:46:76:55:7f:8c:d1:c5:22:31:b9:d7:b1:49:b5:95:a4:f3:ea (vNFGdlV/jNHFIjG517FJtZWk8+o)
  using certificate "C=CH, O=strongSwan Project, CN=SCEP RA"
  using untrusted intermediate certificate "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  reached self-signed root ca with a path length of 1
RA cert is trusted, valid until Aug 10 15:51:34 2023, 'myra.crt'

⚠️ Real talk though: the trustworthiness of the root CA certificate has to be established manually by verifying the SHA256 or SHA1 fingerprint of the DER-encoded certificate — like the one listed on the official PKI website, or by some other means. Do not just trust it because it showed up, bestie. 🙈

The stored certificate files in DER format can be overwritten by PEM-encoded versions with:

pki --scepca --url http://pki.strongswan.org:8080/scep --caout myca.crt --raout myra.crt \
             --outform pem --force

And if the --raout option is omitted and the --caout template doesn't have a file suffix, then with --outform pem the following filenames are derived:

pki --scepca --url http://pki.strongswan.org:8080/scep --caout scep/myca --outform pem

Root CA cert "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
  ...
Root CA cert is untrusted, valid until Aug 12 15:51:34 2032, written to 'scep/myca.pem'
Sub CA cert "C=CH, O=strongSwan Project, CN=strongSwan Issuing CA"
  ...
Sub CA cert is trusted, valid until Aug 12 15:51:34 2027, 'scep/myca-1.pem'
RA cert "C=CH, O=strongSwan Project, CN=SCEP RA"
  ...
RA cert is trusted, valid until Aug 10 15:51:34 2023, 'scep/myca-ra.pem'

And finally — a CA certificate bundle in PEM format written straight to stdout, the classic move:

pki --scepca --url http://pki.strongswan.org:8080/scep --raout myra.crt --outform pem > cacerts.pem

---

💜 SEE ALSO 💜

• pki(1) — go read that one too, she's the whole family. 🫶

---

And that's the page, bestie! This was strongSwan version 6.0.7, dated 2022-08-22 — go get those certs, you absolute icon. 💅✨🎀