Using rules to manage SCEP Certificate objects

You can use rules to control inbound Simple Certificate Enrollment Protocol (SCEP) requests. The rules manage the certificate storage location in Trust Protection Platform based on the request content, existing certificate information, or CA configuration settings.

To create rules for SCEP Certificate object storage

  1. From the Platform menu bar, click Policy Tree.
  2. Navigate to Platforms and click the server object.
  3. Click the Network Device Enrollment tab, and then click the Rules tab.
  4. Click Add.

  5. To store the SCEP Certificate objects in a Policy folder, set the Container and select Use Container if certificate criteria.

  6. (Optional) In the Certificate Origin field, enter the friendly name to be used when new SCEP Certificate objects are added to Trust Protection Platform. The object name will automatically receive the SCEP prefix when created.
  7. (Optional) To require an additional Challenge Password for storage on the Policy folder, select a Password Credential. If the credential is the same as the Default Challenge Password that you specified in the Platforms NDE tab, the rule is ignored.
  8. (Optional) To override the Default CA, type a CA Ident string, select a Certificate Authority, which is a CA template, and then set the RA Certificate Credential.
  9. Click Save.

  10. In the Settings section, enable or disable rules. Use the following chart to determine the appropriate check boxes for managing SCEP rules

    Nothing appears until you click Save

    • To enable and show rules, select the appropriate check boxes, and then click Save.
    • To disable and hide rules, clear the appropriate check boxes, and then click Save.
    • To require the challenge password to manage the certificate storage location, select Match Challenge Password to folder.

    • To require both a challenge password and the folder Distinguished Name (DN) to manage the certificate storage location, select Accept folder in Challenge Password.

    If you defined this rule...

    Enable or disable the rule with this check box

    Corresponding SCEP Rule Type

    Container

    Match X509 Subject to existing certificate object

    Provided Container

    Challenge Password

    Accept container in challenge password

    Select via Password

    Challenge Password

    Match challenge password to container Select via Password

    Use Container if

    Allow X.509 Subject container rules

    Subject Match

    Default CA (all settings)

    Support additional CAs configured on policies CA Ident URL
  11. In the Configured SCEP Rules section, correct any rules that appear in red text, and then click Save.