PR#214: Add SCEP config option to treat the challenge password as an OTP -

certmonger

#214 Add SCEP config option to treat the challenge password as an OTP

Merged Aug 6, 2021 by rcritten. Opened Jul 14, 2021 by rcritten.

rcritten/certmonger bz1577570 into master

Add SCEP config option to treat the challenge password as an OTP

Your Name • Aug 6, 2021

b38981c6e140ada6dd34bc817c508e8dd9714494

rcritten commented Jul 14, 2021

SCEP RFC 8894 specifies that a challenge password SHOULD be
removed from subsequent requests but that it MAY be included.

This adds a new configuration option to treat the challenge password
as a one-time password (OTP) so that it will not be sent on
subsequent requests, like renewals, by removing it completely
from the tracking request.

This allows certmonger to be able to renew AD-issued SCEP certificates
if the AD registry entry DisableRenewalSubjectNameMatch is set to 1.

https://bugzilla.redhat.com/show_bug.cgi?id=1577570

Signed-off-by: Rob Crittenden rcritten@redhat.com

rcritten commented Aug 6, 2021

For testing one needs to add an an AD registry entry because AD subject match is broken:

fire up regedit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP
add a new 32-bit DWORD value named DisableRenewalSubjectNameMatch and set the value to 1

I didn't restart IIS, but you can if you want (in PowerShell run iisreset)

On the certmonger side (with patch) add this to /etc/certmonger/certmonger.conf
[scep]
challenge_password_otp = yes

Restart certmonger

getcert add-scep-ca -c scep -u http://root-ad.vm/certsrv/mscep -v -v -v
getcert request -f /etc/pki/tls/certs/test.pem -k /etc/pki/tls/private/test.key -N hostname -c scep -v -w -g 2048 -L
openssl x509 -text -in /etc/pki/tls/certs/test.pem |grep -i serial -A 1

Now wait. I don't know how long but AD won't immediately re-issue a certificate. I ended up waiting a few hours (because dinner).

getcert resubmit -f /etc/pki/tls/certs/test.pem -v -w
openssl x509 -text -in /etc/pki/tls/certs/test.pem |grep -i serial -A 1

The second serial number should differ from the first.

rebased onto b38981c6e140ada6dd34bc817c508e8dd9714494

Aug 6, 2021

Pull-Request has been merged by rcritten

Aug 6, 2021