SCEP certificate enrollment - packet analysis


1. CA cert request:

Enrolling device requests and installs CA cert.

SCEP Opertion: GetCACert

HTTP Header:

GET /CertSrv/mscep/mscep.dll/pkiclient.exe?operation=GetCACert&message=SCEPLab HTTP/1.0
Host: 10.0.0.6



2. SCEP server returns the CA cert:

In the case of GET operation with a type of GetCACert, the MIME content type returned will 
depend on whether or not an RA is in use. If there is no RA, only the CA certificate is sent back in the response, and the response has the content type tagged as application/x-x509-ca-cert.
If there is an RA, as it is the case in this lab, the RA certificates are sent back together with the CA certificates. The content type is application/x-x509-ca-ra-cert.


HTTP Header:

HTTP/1.1 200 OK
Content-Length: 4170
Content-Type: application/x-x509-ca-ra-cert
Server: Microsoft-IIS/8.0
Date: Mon, 29 Apr 2013 09:15:51 GMT
Connection: close



3. Device requests an identity certificate:

SCEP Operation: PKIOperation

HTTP Header (message string has been truncated):

GET /CertSrv/mscep/mscep.dll/pkiclient.exe?operation=PKIOperation&message=MIITnyeD%0%3D%3D%0A HTTP/1.0
Host: 10.0.0.6



4. SCEP server returns identity cert:

For each GET operation, the CA/RA server will return a MIME object via HTTP. For a GET operation with PKIOperation as its type, the response is tagged as having a Content Type of application/x-pki-message. The body of this message is a BER encoded binary PKI message.

HTTP Header:

HTTP/1.1 200 OK
Content-Length: 2067
Content-Type: application/x-pki-message
Server: Microsoft-IIS/8.0
Date: Mon, 29 Apr 2013 10:46:51 GMT
Connection: close



SCEP Reference: http://www.cisco.com/warp/public/cc/pd/sqsw/tech/scep_wp.htm

1 comment: