SCEP(Simple Certificate Enrollment Protocol)

SCEP(Simple Certificate Enrollment Protocol)

1. RFC documents

• SCEP draft 18

• PKCS #10: Certification Request Syntax Specification

• PKCS #7: Cryptographic Message Syntax

2. SCEP operations

• PKIOperation:      

• Certificate Enrollment - request: PKCSReq, response: PENDING, FAILURE, SUCCESS

• Poll for Requester Initial Certificate - request: GetCertInitial, response: same as for PKCSReq

• Certificate Access - request: GetCert, response: SUCCESS, FAILURE

• CRL Access - request: GetCRL, response: raw DER encoded CRL

• Non-PKIOperation: clear HTTP Get
  

• Get Certificate Authority Certificate - GetCACert, GetNextCACert, GetCACaps

• Get Certificate Authority Certificate Chain - GetCACertChain

3. Request message formats for PKIOperation

• Common fields in all PKIOperation messages:

• senderNonce

• transactionID

• the SCEP message being transported(SCEP messages) -> encrypted using the public key of the recipient(Enveloped-data)
  -> signed by one of certificates(Signed-data): the requester can generate a self-signed certificate, or the requester can use
  a previously issued certificate, if the RA/CA supports the RENEWAL option.
  

• SCEP messages:

• PKCSReq: PKCS#10

• GetCertInitial: messages for old versions of scep clients such as Sscep, AutoSscep, and Openscep, are different with draft-18
         issuerAndSubject ::= SEQUENCE {
              issuer Name,
              subject Name
         }

• GetCert: an ASN.1 IssuerAndSerialNumber type, as specified in PKCS#7 Section 6.7

• GetCRL: an ASN.1 IssuerAndSerialNumber type, as defined in PKCS#7 Section 6.7