# Certificate Connector

| Category                                                                        | SCEPman                                                                                                                                                                                                                                           | Microsoft CA with PKCS                                                                                                                                                                                                                                                                                                                                                                                                                                       | NDES with SCEP                                                                                                                                                                                                                                                                     |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Set-up Effort**                                                               | <p><mark style="color:green;"><strong>< 30 minutes</strong></mark></p><ul><li><a href="/pages/K72fpTZcpCv2dzmdnOdW">3-step deployment procedure</a> for core functionality</li></ul>                                                              | <p><mark style="color:orange;"><strong>> 2 - 3 days</strong></mark></p><ul><li>CDP\* design and implementation</li><li>Certificate Templates configuration</li><li>Configuration compatibility – GPOs, Service Accounts, Connector Versions, ...</li></ul>                                                                                                                                                                                                   | <p><mark style="color:red;"><strong>> + 2 days</strong></mark></p><p><em>In addition to PKCS:</em></p><ul><li>Additional server(s) for NDES</li><li>One NDES server for each type of certificate</li><li>Two additional Certificate Templates</li><li>Difficult to debug</li></ul> |
| **PKI Maintenance**                                                             | <ul><li><a href="/pages/tFsgPuXD0a2C2RZXsGNI">Automatic health monitoring in Azure</a></li></ul>                                                                                                                                                  | <ul><li><a href="https://github.com/glueckkanja-pki/PKI-Monitoring-Tools">CDP Monitoring</a></li><li>Monitoring of the Certificate Connector</li></ul>                                                                                                                                                                                                                                                                                                       | <p><em>In addition to PKCS:</em></p><ul><li>Manual Enrolment Agent certificate renewal</li></ul>                                                                                                                                                                                   |
| **Server Maintenance**                                                          | <ul><li><a href="/pages/YdA5aXwMLA3hSTZNYES9">Automatic updates / patches</a></li></ul>                                                                                                                                                           | <ul><li>Operating system updates</li><li>Monitoring</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                | <p><em>In addition to PKCS:</em></p><ul><li>Operating system updates and monitoring for at least one additional server</li></ul>                                                                                                                                                   |
| <p><strong>Certificate Management</strong><br>Issuance, renewal, revocation</p> | <ul><li>Fully-automated enrolment and renewal</li><li><a href="/pages/S1hdnLPdm2YshbFHAY3g">Fully-automated revocation</a></li><li>Manual revocation option</li></ul>                                                                             | <ul><li>Fully-automated enrolment and renewal</li><li>Manual revocation (difficult to search the database)</li></ul>                                                                                                                                                                                                                                                                                                                                         | *Like PKCS.*                                                                                                                                                                                                                                                                       |
| **Availability**                                                                | <p>Singular Design</p><ul><li>App Service SLA: > 99.95 % Uptime</li></ul><p>Redundant Design</p><ul><li>Traffic Manager SLA: > 99.99 % Uptime</li></ul>                                                                                           | <p>Multiple failure modes:</p><ul><li>Virtualization platform</li><li>Operating system</li><li>CDP webserver</li></ul><p>Redundant Design</p><ul><li>Standby CA server</li><li>Additional CDP webservers</li><li>Standby server for backup Certificate Connector</li></ul>                                                                                                                                                                                   | <p><em>Like PKCS.</em></p><p>Redundant Design</p><ul><li>Additional NDES servers</li></ul>                                                                                                                                                                                         |
| **Scalability**                                                                 | <ul><li><a href="/pages/TIJ26UKEHcAiNH5Eia8f">Autoscaling or manual scaling with a few clicks</a></li><li><a href="/pages/ROQrYA83dZwfEAVmNsTN">Serve any number of clients with one SCEPman CA.</a></li></ul>                                    | <ul><li>No autoscaling</li><li>Scaling requires CA cluster</li><li><a href="https://social.technet.microsoft.com/wiki/contents/articles/9256.active-directory-certificate-services-ad-cs-clustering.aspx">Complex manual scaling</a></li></ul>                                                                                                                                                                                                               | <p><em>Like PKCS.</em></p><ul><li>Further effort for duplicating NDES servers</li></ul>                                                                                                                                                                                            |
| **Backup**                                                                      | <ul><li>SCEPman is stateless for core functionality, i.e. no backup is required.</li><li>SCEPman Root CA is implicitly backed-up by Azure KeyVault (region-redundant).</li><li>Optional Storage Account can be backed-up automatically.</li></ul> | <ul><li>Regular CA database backups</li><li>CA key and configuration backup (high compliance and security requirements)</li></ul>                                                                                                                                                                                                                                                                                                                            | *Like PKCS.*                                                                                                                                                                                                                                                                       |
| **Security**                                                                    | <ul><li>Designed based on Zero-Trust approach (cloud-native)</li><li>Use of state-of-the art authentication schemes</li><li>Automatic certificate revocation in real-time with OCSP (human error impossible)</li></ul>                            | <ul><li>Designed for on-premises use</li><li>Susceptible for "<a href="/pages/fKyq5X8lTidpZdk0qxpT">certifried attack</a>"</li><li>Increased attack surface due to additional communication channel between CA (tier 0 asset) and the internet</li><li>Increased attack surface due to usage of on-premises and cloud accounts</li><li>Actuality of CRL depends on refresh interval</li><li>OCSP is based on CRL and <strong>not realtime</strong></li></ul> | <p><em>Like PKCS.</em></p><ul><li>Requires inbound access to NDES (<a href="https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ndes-security-best-practices/ba-p/2832619">tier 0 asset</a>)</li></ul>                                                         |
| **Flexibility**                                                                 | <ul><li>Use of standardized interfaces (SCEP, OCSP, REST)</li><li>Support of multiple MDM solutions</li></ul>                                                                                                                                     | <ul><li>Only Intune is supported</li><li>Proprietary RPC interface allows auto-enrolment of certificates on legacy domain-joined clients</li></ul>                                                                                                                                                                                                                                                                                                           | <ul><li>Support of multiple MDM solutions possible (additional NDES instance required)</li></ul>                                                                                                                                                                                   |

\*: CRL Distribution Point


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.scepman.com/other/faqs/certificate-connector.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.