Simple Certificate Enrollment Protocol Demo/Interop

Interoperate with the Redwax Simple Certificate Enrollment Protocol module.

We have implemented a SCEP endpoint that allows you to test your client implementation against a Redwax Server.

The code being run is the most up to date build from trunk/master in source control, and is built and deployed automatically. The Redwax Interop server is for testing purposes only.

Simple Certificate Enrollment Protocol (SCEP) Demo/Interop Server

When testing your SCEP client implementation, use the following details.


SCEP Alternative URL
Time Source System Clock
Serial Numbers Random

Redwax Module Configuration

The following configuration is used to implement this SCEP server. The configuration below is added to a standard secure virtualhost Apache configuration, as described here.


Here we set the SCEP handler, and set the CA certificates and keys to be used for signing.

We also set an RA certificate and key that is used during the SCEP certificate issuing process. This certificate is signed by our CA certificate.

<IfModule !ca_module>
  LoadModule ca_module /usr/lib64/httpd/modules/
<IfModule !ca_simple_module>
  LoadModule ca_simple_module /usr/lib64/httpd/modules/
<IfModule !scep_module>
  LoadModule scep_module /usr/lib64/httpd/modules/

<Location /test/simple>

  CASimpleCertificate /etc/pki/interop/ca-cert.pem
  CASimpleKey /etc/pki/interop/private/ca-key.pem
  CASimpleDays 1
  CASimpleTime on
  CASimpleAlgorithm RSA rsa_keygen_bits=4096
  CASimpleSerialRandom on

  CASimpleExtension basicConstraints CA:FALSE
  CASimpleExtension keyUsage critical,nonRepudiation,digitalSignature,keyEncipherment
  CASimpleExtension extendedKeyUsage OID:
  CASimpleExtension subjectKeyIdentifier hash
  CASimpleExtension authorityKeyIdentifier keyid,issuer


<Location /test/simple/scep>
  Require all granted
  SetHandler scep
  ScepRACertificate /etc/pki/interop/scep-ra.cert
  ScepRAKey /etc/pki/interop/private/scep-ra.key
  ScepSubjectRequest O
  ScepSubjectRequest CN
  ScepSubjectRequest C
  ScepSubjectAltNameRequest rfc822Name


SCEP with Apple MacOS and iOS

Apple's MacOS and iOS operating systems support SCEP via the mobileconfig profile as generated by Apple Configurator.


A mobileconfig profile is an XML file that contains a set of configurations for a MacOS or iOS device.

Download the mobileconfig file or cut and paste it below. Open the file from MacOS or from email in iOS or MacOS, and the SCEP client will request a test certificate from the Redwax SCEP server.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "">
<plist version="1.0">
          <key>Key Type</key>
          <key>Key Usage</key>
        <string>Configures SCEP settings</string>
    <string>This profile installs a testing certificate using the SCEP protocol.</string>
    <string>Redwax Interop/Demo</string>
    <string>Redwax Project</string>



Once installed, the profile will look similar to the following.

Screenshot of profile


The resulting certificate in the Keychain will look similar to the following.

Screenshot of certificate

SCEP with Mikrotik RouterOS

Mikrotik's Routerboard and RouterOS support a SCEP client, and can request certificates from a Redwax Server.

Command Line

Add a certificate template, followed by a SCEP definition, as follows.

[admin@router] /> /certificate
[admin@router] /certificate> add common-name=test-cn name=test-name                                         
[admin@router] /certificate> add-scep template=test-name


Confirm that the certificate was requested and issued correctly.

[admin@router] /certificate> print detail 
Flags: K - private-key, L - crl, C - smart-card-key, A - authority, 
I - issued, R - revoked, E - expired, T - trusted 
 0 K     T name="test-name" 
           issuer=CN=Redwax Interop Testing Root Certificate Authority 2040,O=Redwax 
           digest-algorithm=sha256 key-type=rsa common-name="test-cn" key-size=2048 
           subject-alt-name="" days-valid=2 trusted=yes 
           invalid-before=feb/15/2020 00:32:05 invalid-after=feb/17/2020 00:32:05 
           expires-after=23h47m2s challenge-password="" status="idle" 

 1       T name="test-name_CA" 
           issuer=CN=Redwax Interop Testing Root Certificate Authority 2040,O=Redwax 
           digest-algorithm=sha1 key-type=rsa organization="Redwax Project" 
           common-name="Redwax Interop Testing Root Certificate Authority 2040" 
           key-size=2048 subject-alt-name="" days-valid=6534 trusted=yes 
           invalid-before=feb/11/2020 17:38:56 invalid-after=jan/01/2038 17:38:56