# Certificate Connector

| Category                                                                        | SCEPman                                                                                                                                                                                                                                           | Microsoft CA with PKCS                                                                                                                                                                                                                                                                                                                                                                                                                                         | NDES with SCEP                                                                                                                                                                                                                                                                     |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Set-up Effort**                                                               | <p><mark style="color:green;"><strong>< 30 minutes</strong></mark></p><ul><li><a href="../../scepman-deployment/deployment-guides">3-step deployment procedure</a> for core functionality</li></ul>                                               | <p><mark style="color:orange;"><strong>> 2 - 3 days</strong></mark></p><ul><li>CDP\* design and implementation</li><li>Certificate Templates configuration</li><li>Configuration compatibility – GPOs, Service Accounts, Connector Versions, ...</li></ul>                                                                                                                                                                                                     | <p><mark style="color:red;"><strong>> + 2 days</strong></mark></p><p><em>In addition to PKCS:</em></p><ul><li>Additional server(s) for NDES</li><li>One NDES server for each type of certificate</li><li>Two additional Certificate Templates</li><li>Difficult to debug</li></ul> |
| **PKI Maintenance**                                                             | <ul><li><a href="../../azure-configuration/health-check">Automatic health monitoring in Azure</a></li></ul>                                                                                                                                       | <ul><li><a href="https://github.com/glueckkanja-pki/PKI-Monitoring-Tools">CDP Monitoring</a></li><li>Monitoring of the Certificate Connector</li></ul>                                                                                                                                                                                                                                                                                                         | <p><em>In addition to PKCS:</em></p><ul><li>Manual Enrolment Agent certificate renewal</li></ul>                                                                                                                                                                                   |
| **Server Maintenance**                                                          | <ul><li><a href="../../azure-configuration/update-strategy">Automatic updates / patches</a></li></ul>                                                                                                                                             | <ul><li>Operating system updates</li><li>Monitoring</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                  | <p><em>In addition to PKCS:</em></p><ul><li>Operating system updates and monitoring for at least one additional server</li></ul>                                                                                                                                                   |
| <p><strong>Certificate Management</strong><br>Issuance, renewal, revocation</p> | <ul><li>Fully-automated enrolment and renewal</li><li><a href="../../scepman-configuration/device-directories">Fully-automated revocation</a></li><li>Manual revocation option</li></ul>                                                          | <ul><li>Fully-automated enrolment and renewal</li><li>Manual revocation (difficult to search the database)</li></ul>                                                                                                                                                                                                                                                                                                                                           | *Like PKCS.*                                                                                                                                                                                                                                                                       |
| **Availability**                                                                | <p>Singular Design</p><ul><li>App Service SLA: > 99.95 % Uptime</li></ul><p>Redundant Design</p><ul><li>Traffic Manager SLA: > 99.99 % Uptime</li></ul>                                                                                           | <p>Multiple failure modes:</p><ul><li>Virtualization platform</li><li>Operating system</li><li>CDP webserver</li></ul><p>Redundant Design</p><ul><li>Standby CA server</li><li>Additional CDP webservers</li><li>Standby server for backup Certificate Connector</li></ul>                                                                                                                                                                                     | <p><em>Like PKCS.</em></p><p>Redundant Design</p><ul><li>Additional NDES servers</li></ul>                                                                                                                                                                                         |
| **Scalability**                                                                 | <ul><li><a href="../../azure-configuration/azure-sizing/autoscaling">Autoscaling or manual scaling with a few clicks</a></li><li><a href="../../azure-configuration/azure-sizing">Serve any number of clients with one SCEPman CA.</a></li></ul>  | <ul><li>No autoscaling</li><li>Scaling requires CA cluster</li><li><a href="https://social.technet.microsoft.com/wiki/contents/articles/9256.active-directory-certificate-services-ad-cs-clustering.aspx">Complex manual scaling</a></li></ul>                                                                                                                                                                                                                 | <p><em>Like PKCS.</em></p><ul><li>Further effort for duplicating NDES servers</li></ul>                                                                                                                                                                                            |
| **Backup**                                                                      | <ul><li>SCEPman is stateless for core functionality, i.e. no backup is required.</li><li>SCEPman Root CA is implicitly backed-up by Azure KeyVault (region-redundant).</li><li>Optional Storage Account can be backed-up automatically.</li></ul> | <ul><li>Regular CA database backups</li><li>CA key and configuration backup (high compliance and security requirements)</li></ul>                                                                                                                                                                                                                                                                                                                              | *Like PKCS.*                                                                                                                                                                                                                                                                       |
| **Security**                                                                    | <ul><li>Designed based on Zero-Trust approach (cloud-native)</li><li>Use of state-of-the art authentication schemes</li><li>Automatic certificate revocation in real-time with OCSP (human error impossible)</li></ul>                            | <ul><li>Designed for on-premises use</li><li>Susceptible for "<a href="../troubleshooting/certifried">certifried attack</a>"</li><li>Increased attack surface due to additional communication channel between CA (tier 0 asset) and the internet</li><li>Increased attack surface due to usage of on-premises and cloud accounts</li><li>Actuality of CRL depends on refresh interval</li><li>OCSP is based on CRL and <strong>not realtime</strong></li></ul> | <p><em>Like PKCS.</em></p><ul><li>Requires inbound access to NDES (<a href="https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ndes-security-best-practices/ba-p/2832619">tier 0 asset</a>)</li></ul>                                                         |
| **Flexibility**                                                                 | <ul><li>Use of standardized interfaces (SCEP, OCSP, REST)</li><li>Support of multiple MDM solutions</li></ul>                                                                                                                                     | <ul><li>Only Intune is supported</li><li>Proprietary RPC interface allows auto-enrolment of certificates on legacy domain-joined clients</li></ul>                                                                                                                                                                                                                                                                                                             | <ul><li>Support of multiple MDM solutions possible (additional NDES instance required)</li></ul>                                                                                                                                                                                   |

\*: CRL Distribution Point